2026-08-02_309ecc0bab04f59f9c879009e547a6a7_darkgate_elex_gcleaner_helldown_poet-rat

General

Target
2026-08-02_309ecc0bab04f59f9c879009e547a6a7_darkgate_elex_gcleaner_helldown_poet-rat
Size 6.5MB
Sample260802-dwwl7asvbx
SHA256 18811c4f4c38f9459439de2ac7500914f7f986231db682217a0ff3878755b344
MD5 309ecc0bab04f59f9c879009e547a6a7
SHA1 1820aafa31aa83e6eed428a09650e2669c048665
SHA512 101e6af66511f4af58d31a540006f45b473dd6c4f8a6f36c68778294165aaade58f6ef85a1189b2078ac89f1f75f7e9111dce149c26621f11596e8269a0484ca
SSDEEP 98304:/wTgG7J+Mfr7Wxriwr9JQ3ozWMtQOC4t4:/wTg1Qr7WO37MLC4t4
TLSH
T1B5662231E251D837C1A306B48DE2C735816E9E7C2B1391C767F92C8BB9265DA7F20693
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with Enigma 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Enigma

Detects packed executables observed in Molerats 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Loader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_309ecc0bab04f59f9c879009e547a6a7_darkgate_elex_gcleaner_helldown_poet-rat

File Explorer

2026-08-02_309ecc0bab04f59f9c879009e547a6a7_darkgate_elex_gcleaner_helldown_poet-rat

.exe 6.5MB

2026-08-02_309ecc0bab04f59f9c879009e547a6a7_darkgate_elex_gcleaner_helldown_poet-rat

SHA256 18811c4f4c38f9459439de2ac7500914f7f986231db682217a0ff3878755b344
MD5 309ecc0bab04f59f9c879009e547a6a7
SHA1 1820aafa31aa83e6eed428a09650e2669c048665
SHA512 101e6af66511f4af58d31a540006f45b473dd6c4f8a6f36c68778294165aaade58f6ef85a1189b2078ac89f1f75f7e9111dce149c26621f11596e8269a0484ca
SSDEEP 98304:/wTgG7J+Mfr7Wxriwr9JQ3ozWMtQOC4t4:/wTg1Qr7WO37MLC4t4
TLSH
T1B5662231E251D837C1A306B48DE2C735816E9E7C2B1391C767F92C8BB9265DA7F20693
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects executables packed with Enigma
Detects packed executables observed in Molerats
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

246939

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\svn\sdtx_launcher\proj.win32\Release.win32\sdtx_launcher.pdb

Name

.text

Size

247KB

Virtual Size

247KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

129KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

363KB

Virtual Size

363KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.enigma1

Size

5.5MB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.enigma2

Size

300KB

Virtual Size

300KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_309ecc0bab04f59f9c879009e547a6a7_darkgate_elex_gcleaner_helldown_poet-rat

generic