2026-07-10_10425556a48fdb1f59bd630ffad2f2fb_amadey_darkgate_elex_gcleaner_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_10425556a48fdb1f59bd630ffad2f2fb_amadey_darkgate_elex_gcleaner_remcos_smoke-loader
Size 10.4MB
Sample260710-cmdjksb17r
SHA256 ae39fae808d49d806202eeb50059e4341374b3fa40be76d6b674412fb7677caf
MD5 10425556a48fdb1f59bd630ffad2f2fb
SHA1 484e042281191b6c76c68d504c19a1f6799f136b
SHA512 16c1b47f6224c3711b1afe5acf2be4fbd0c67d03c2610da0fe00f79db6d7d1f06f4ad6f98710dd84fbaa040bbece6cf29f0e6e7f1afa613b4c345c1cb534dd7f
SSDEEP 24576:e3dn3wcPvGIqoHzR2oxQxf548XSt2vW5A5eN/:m3weyzbc/
TLSH
T1CCB6AE11B5E1E03EC4E556B00CAB777AD4286F0C0B249DD3B7E03EA95D32EE25E3525A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with Enigma 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Enigma

Detects packed executables observed in Molerats 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Loader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_10425556a48fdb1f59bd630ffad2f2fb_amadey_darkgate_elex_gcleaner_remcos_smoke-loader

File Explorer

2026-07-10_10425556a48fdb1f59bd630ffad2f2fb_amadey_darkgate_elex_gcleaner_remcos_smoke-loader

.exe 10.4MB

2026-07-10_10425556a48fdb1f59bd630ffad2f2fb_amadey_darkgate_elex_gcleaner_remcos_smoke-loader

IMPHASH 1bd7cdba468966326cb6c9d666c4738e
SHA256 ae39fae808d49d806202eeb50059e4341374b3fa40be76d6b674412fb7677caf
MD5 10425556a48fdb1f59bd630ffad2f2fb
SHA1 484e042281191b6c76c68d504c19a1f6799f136b
SHA512 16c1b47f6224c3711b1afe5acf2be4fbd0c67d03c2610da0fe00f79db6d7d1f06f4ad6f98710dd84fbaa040bbece6cf29f0e6e7f1afa613b4c345c1cb534dd7f
SSDEEP 24576:e3dn3wcPvGIqoHzR2oxQxf548XSt2vW5A5eN/:m3weyzbc/
TLSH
T1CCB6AE11B5E1E03EC4E556B00CAB777AD4286F0C0B249DD3B7E03EA95D32EE25E3525A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables packed with Enigma
Detects packed executables observed in Molerats
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

315258

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

mmioGetInfo mmioAdvance mmioSetInfo mmioSeek mmioOpenA mmioClose mmioDescend mmioRead mmioAscend mciSendCommandA timeEndPeriod timeGetDevCaps timeBeginPeriod timeGetTime

dsound

ord1

dinput

DirectInputCreateEx

comctl32

ord17

imm32

ImmGetConversionStatus ImmGetOpenStatus ImmSetCompositionFontA ImmGetContext ImmSetOpenStatus ImmReleaseContext ImmSetConversionStatus

kernel32

EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection SuspendThread ResumeThread MultiByteToWideChar WaitForSingleObject CreateFileA CloseHandle ReadFile WriteFile GetFileSize SetFilePointer GetCurrentProcess GetFileTime FileTimeToSystemTime FileTimeToLocalFileTime lstrcpyA ReleaseMutex CreateMutexA OpenMutexA GetDriveTypeA FindClose CreateDirectoryA FindFirstFileA GetModuleFileNameA SetEvent ResetEvent CreateEventA LockResource LoadResource FindResourceA GetCurrentThreadId HeapAlloc GetProcessHeap GetVersionExA HeapFree WaitForMultipleObjects UnlockFile SetEndOfFile FlushFileBuffers LockFile GetLocalTime ExitProcess RtlUnwind RaiseException lstrcmpiA GetModuleHandleA TerminateProcess ExitThread GetLastError CreateThread GetSystemTimeAsFileTime GetStartupInfoA GetCommandLineA HeapReAlloc QueryPerformanceCounter GetCurrentProcessId TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue SetUnhandledExceptionFilter HeapSize HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr GetACP GetOEMCP GetCPInfo UnhandledExceptionFilter SetHandleCount GetStdHandle GetFileType FreeEnvironmentStringsA GetEnvironmentStrings GetTickCount WideCharToMultiByte GetEnvironmentStringsW LoadLibraryA InterlockedExchange VirtualQuery IsBadReadPtr IsBadCodePtr LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetStdHandle GetLocaleInfoA VirtualProtect GetSystemInfo Sleep lstrcatA GetProcAddress SetThreadPriority FreeEnvironmentStringsW

user32

SetFocus SetForegroundWindow SetWindowPos GetClientRect GetDesktopWindow AdjustWindowRect PostQuitMessage SetWindowLongA ShowWindow DestroyWindow OpenIcon InvalidateRect CloseWindow IsIconic DrawMenuBar SetMenu WINNLSEnableIME LoadMenuA ReleaseDC GetDC SendMessageA IsWindowVisible UpdateWindow GetFocus GetWindowRect ClientToScreen ScreenToClient EnableWindow MoveWindow PostMessageA DefWindowProcA GetWindowLongA CallWindowProcA CreateWindowExA DialogBoxParamA MessageBoxA SetRect EndDialog GetDlgItem SendDlgItemMessageA CopyImage GetCursorPos UnionRect RegisterClassExA LoadCursorA LoadIconA EndPaint BeginPaint SetCursorPos CheckMenuItem SetCursor GetCursor ChangeDisplaySettingsA IntersectRect SetWindowTextA SetDlgItemTextA CheckDlgButton SetDlgItemInt IsDlgButtonChecked GetDlgItemInt DestroyMenu AppendMenuA GetSubMenu TranslateMessage DispatchMessageA GetActiveWindow wsprintfA EnableMenuItem GetSystemMetrics CreateDialogParamA PeekMessageA

gdi32

SetBkColor SetTextColor SetStretchBltMode SetGraphicsMode GetStockObject GetGlyphOutlineA TextOutA GetDeviceCaps GetTextMetricsA EnumFontFamiliesExA SetBkMode DeleteDC SelectObject CreateDIBSection CreateCompatibleDC CreateFontIndirectA BitBlt DeleteObject

shell32

ShellExecuteA

ole32

CoInitialize CoCreateInstance CoUninitialize

Name

.text

Size

413KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

9.7MB

Virtual Size

9.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

31KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.enigma1

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.enigma2

Size

290KB

Virtual Size

292KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_10425556a48fdb1f59bd630ffad2f2fb_amadey_darkgate_elex_gcleaner_remcos_smoke-loader

winmm

dsound

dinput

comctl32

imm32

kernel32

user32

gdi32

shell32

ole32

generic