Extracted

• • Target
    2026-05-28_58c56f1da856552ded8d00f728b6ed13_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop
  • Size 12.8MB
  • SHA256 6227f7a8286f897ecbfa570340b6cd22914f540606fa051e28d92b4a23abed29
  • MD5 58c56f1da856552ded8d00f728b6ed13
  • SHA1 11d172160de152aafeab2f4a753933bae0e45083
  • SHA512 85bad71089e59492b786e5a18f22091a7192985a0c028c4b443e5f28924ac10e13a296808ef2e7c71519dd20006f9163b1cbe0f34044171ceeaf8acccf541820
  • SSDEEP 196608:yLx8j790miokb/iLIkAIOnUWndpb12IGKLRWch7jjQuB3fq3SyJfnol1x2ZruWgI:yVHoIK+nUWndpNWch7jJB3aSyWLCy3of
  • TLSH
    T1A2D6233372A00176C1E78D39CC3BFEA070B636665E5164BA7BF96DCB1E265C1A613183
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  adwaredefense_evasiondiscoveryinstallermacropersistenceprivilege_escalationspywarethemidatrojan

  • Detects executables packed with Themida

  • Detects executables packed with VMProtect.

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2