2026-07-12_b5f10472e70c628087d9d4e14254f61f_amadey_darkgate_elex_gcleaner_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-12_b5f10472e70c628087d9d4e14254f61f_amadey_darkgate_elex_gcleaner_remcos_smoke-loader
Size 4.2MB
Sample260712-1lay3abs6s
SHA256 5aa3912183456873e61d396e04536e5496563680a903394c99fbed59bd8709e9
MD5 b5f10472e70c628087d9d4e14254f61f
SHA1 ad06f2b3b7b40b79568290bd1390888d27b63239
SHA512 a06fe13f4da81ad612870ac2d124c3c81d8638c500c01503e40ed5ab70c7e2e354f3fd43c950b14aa2d005c9805ac92c4a3a9ba28dd033cde5237d93a1b7ec40
SSDEEP 12288:ha2BcFsZcWZBzBpNq/MISlcEyOXqY7RC0WysJMBW5ALWFuyoA:JSMFZjpk/MISlVXqY7RC0WkBW5AaFuA
TLSH
T104166B21B7D1C8B3C1A218741C1DD3A68AB9FE249B3157D37FE53B4EAE782D11E25206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with Enigma 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Enigma

Detects packed executables observed in Molerats 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Loader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-12_b5f10472e70c628087d9d4e14254f61f_amadey_darkgate_elex_gcleaner_remcos_smoke-loader

File Explorer

2026-07-12_b5f10472e70c628087d9d4e14254f61f_amadey_darkgate_elex_gcleaner_remcos_smoke-loader

.exe 4.2MB

2026-07-12_b5f10472e70c628087d9d4e14254f61f_amadey_darkgate_elex_gcleaner_remcos_smoke-loader

IMPHASH 0be6eb33581160e2ab6d47c61533d938
SHA256 5aa3912183456873e61d396e04536e5496563680a903394c99fbed59bd8709e9
MD5 b5f10472e70c628087d9d4e14254f61f
SHA1 ad06f2b3b7b40b79568290bd1390888d27b63239
SHA512 a06fe13f4da81ad612870ac2d124c3c81d8638c500c01503e40ed5ab70c7e2e354f3fd43c950b14aa2d005c9805ac92c4a3a9ba28dd033cde5237d93a1b7ec40
SSDEEP 12288:ha2BcFsZcWZBzBpNq/MISlcEyOXqY7RC0WysJMBW5ALWFuyoA:JSMFZjpk/MISlVXqY7RC0WkBW5AaFuA
TLSH
T104166B21B7D1C8B3C1A218741C1DD3A68AB9FE249B3157D37FE53B4EAE782D11E25206
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables packed with Enigma
Detects packed executables observed in Molerats
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

309260

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

timeEndPeriod mciSendCommandA timeGetTime mciGetErrorStringA mixerGetControlDetailsA waveOutOpen waveOutClose waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite timeBeginPeriod timeGetDevCaps mciSendStringA mixerSetControlDetails mixerGetNumDevs mixerOpen mixerGetDevCapsA mixerClose mixerGetLineInfoA mixerGetLineControlsA

dsound

ord1

msacm32

acmStreamClose acmStreamConvert acmStreamPrepareHeader acmStreamSize acmStreamOpen acmFormatSuggest acmStreamUnprepareHeader

kernel32

HeapSize LCMapStringW WideCharToMultiByte LCMapStringA SetEndOfFile SetStdHandle InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection Sleep ResetEvent CreateDirectoryA GetWindowsDirectoryA ReleaseMutex GetCurrentDirectoryA MultiByteToWideChar LoadLibraryA GetProcAddress GetModuleFileNameA CreateMutexA CloseHandle OpenMutexA ReadFile CreateFileA WriteFile LocalFree LocalUnlock LocalLock LocalAlloc FreeLibrary GetTickCount WaitForMultipleObjects GetVersionExA GetDriveTypeA GetVolumeInformationA SetFilePointer InterlockedIncrement InterlockedDecrement HeapFree HeapAlloc GetProcessHeap MulDiv CreateEventA OutputDebugStringA GetPrivateProfileStringA WinExec GlobalFree GlobalUnlock GlobalLock GetStringTypeA GetFileSize GetStdHandle SetHandleCount TlsGetValue TlsSetValue TlsFree SetLastError TlsAlloc GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy GetCommandLineA GetStartupInfoA CreateThread ResumeThread ExitThread GetLocalTime HeapCompact PeekNamedPipe GetFileInformationByHandle FileTimeToLocalFileTime FileTimeToSystemTime HeapReAlloc SetCurrentDirectoryA SetEnvironmentVariableA GetCPInfo GetOEMCP GetACP VirtualProtect RtlUnwind GetCurrentProcess TerminateProcess GetModuleHandleA GetFileType DeleteFileA GetFileAttributesA GetLastError ExitProcess GetSystemInfo VirtualQuery GetTimeZoneInformation UnhandledExceptionFilter FreeEnvironmentStringsA GetStringTypeW GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW InterlockedExchange FlushFileBuffers GetLocaleInfoA SetUnhandledExceptionFilter IsBadReadPtr IsBadCodePtr RaiseException CompareStringA CompareStringW GlobalAlloc RemoveDirectoryA

user32

GetWindowRect SetCursorPos SetWindowTextA EnableWindow GetDlgItem EndDialog SetFocus ShowWindow ClientToScreen GetMenu ScrollDC SendMessageA GetCursorPos ScreenToClient SetCursor SetMenu UpdateWindow PostMessageA BeginPaint KillTimer SetTimer DestroyMenu ChangeDisplaySettingsA PostQuitMessage DrawMenuBar MoveWindow GetWindowTextA DialogBoxParamA SetMenuItemInfoA SetWindowPos GetWindowLongA SetWindowLongA DefWindowProcA InsertMenuItemA DestroyWindow InvalidateRect FillRect MessageBoxA GetDC ReleaseDC LoadIconA LoadCursorA RegisterClassA GetSystemMetrics AdjustWindowRect LoadAcceleratorsA LoadMenuA CreateWindowExA GetForegroundWindow GetAsyncKeyState PeekMessageA TranslateAcceleratorA TranslateMessage DispatchMessageA DeleteMenu CreateMenu LoadImageA CreateDialogParamA GetSubMenu CallWindowProcA GetMessageA EndPaint

gdi32

GetStockObject DeleteDC DeleteObject TextOutA CreateFontA BitBlt SetBkMode SetTextColor EnumFontFamiliesExA StretchBlt SetStretchBltMode StretchDIBits GetDeviceCaps CreateDIBSection SelectObject SetBkColor CreateSolidBrush CreateCompatibleDC

advapi32

RegQueryValueExA RegOpenKeyA RegCloseKey

shell32

ShellExecuteA

ole32

CoUninitialize CoInitialize CreateStreamOnHGlobal CoCreateInstance

oleaut32

OleLoadPicture

Name

.text

Size

354KB

Virtual Size

356KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.enigma1

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.enigma2

Size

290KB

Virtual Size

292KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-12_b5f10472e70c628087d9d4e14254f61f_amadey_darkgate_elex_gcleaner_remcos_smoke-loader

winmm

dsound

msacm32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic