2026-06-26_061fec24c2416171c85526a877b6db49_amadey_darkgate_elex_medusalocker_remcos_smoke-loader

General

Target
2026-06-26_061fec24c2416171c85526a877b6db49_amadey_darkgate_elex_medusalocker_remcos_smoke-loader
Size 396KB
Sample260629-w6caeady4p
SHA256 a6b27e45a9ab6b3268569f437070066cc4d8223947bbcbf78fcf30e6735be299
MD5 061fec24c2416171c85526a877b6db49
SHA1 7a04b8bf39e8223714c841673619f9922d597fcc
SHA512 4e11ef248dbd8330836112bad67e1d9e911d003c1c9e46554a6dab925a6715c4510ce041184a33e94b1e63016b7bcca46322565df5fd55ba2fa033d55bbfeec8
SSDEEP 6144:oMVormVOKKV2GHVUJV8nY/VmC2AKiszTAg2HS4fV26UtW/Gp43C38xqHUQfx7AOm:4a211VwV2vcC3LUQFsIK7V
TLSH
T138845CA03140D0B6D5B756F9CFA8FA39917C6E50173028F72AE06BA91EB54D3DC3172A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-26_061fec24c2416171c85526a877b6db49_amadey_darkgate_elex_medusalocker_remcos_smoke-loader

File Explorer

2026-06-26_061fec24c2416171c85526a877b6db49_amadey_darkgate_elex_medusalocker_remcos_smoke-loader

.exe 396KB

2026-06-26_061fec24c2416171c85526a877b6db49_amadey_darkgate_elex_medusalocker_remcos_smoke-loader

IMPHASH ba2eb862410bb6d9b40827b94e0658ac
SHA256 a6b27e45a9ab6b3268569f437070066cc4d8223947bbcbf78fcf30e6735be299
MD5 061fec24c2416171c85526a877b6db49
SHA1 7a04b8bf39e8223714c841673619f9922d597fcc
SHA512 4e11ef248dbd8330836112bad67e1d9e911d003c1c9e46554a6dab925a6715c4510ce041184a33e94b1e63016b7bcca46322565df5fd55ba2fa033d55bbfeec8
SSDEEP 6144:oMVormVOKKV2GHVUJV8nY/VmC2AKiszTAg2HS4fV26UtW/Gp43C38xqHUQfx7AOm:4a211VwV2vcC3LUQFsIK7V
TLSH
T138845CA03140D0B6D5B756F9CFA8FA39917C6E50173028F72AE06BA91EB54D3DC3172A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

126777

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\work\popularize_group\universal_safekey\app_locker_service\SafeKeyBuild\app_locker_service.pdb

kernel32

MultiByteToWideChar FreeLibrary SetLastError OutputDebugStringW GetCommandLineW VirtualProtect GetCurrentProcessId SetUnhandledExceptionFilter GetCurrentThreadId LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CloseHandle LoadLibraryW GetProcAddress GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW HeapFree HeapReAlloc HeapAlloc GetLastError RaiseException DecodePointer WideCharToMultiByte GetStringTypeW TryEnterCriticalSection EncodePointer InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW QueryPerformanceCounter LCMapStringW GetCPInfo IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess IsProcessorFeaturePresent VirtualAlloc VirtualFree CreateFileW FindClose FindNextFileW SetEvent TerminateProcess GetStartupInfoW FlushFileBuffers WriteFile UnhandledExceptionFilter WaitForSingleObjectEx Sleep SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW DuplicateHandle ReleaseSemaphore InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue RtlUnwind GetModuleHandleExW ExitProcess GetStdHandle GetFileType SetFilePointerEx GetConsoleOutputCP GetConsoleMode FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-26_061fec24c2416171c85526a877b6db49_amadey_darkgate_elex_medusalocker_remcos_smoke-loader

kernel32

generic