2026-09-29_11e79304bb3abfae27fc897931e5eb19_amadey_darkgate_elex_gcleaner_remcos_smoke-loader_stop

General

Target
2026-09-29_11e79304bb3abfae27fc897931e5eb19_amadey_darkgate_elex_gcleaner_remcos_smoke-loader_stop
Size 12.3MB
Sample260930-3x2x2ayajc
SHA256 7730ef4fb3a22c08cdaf3d8860dfaae483e5478e3676f1bb506ceaa445242720
MD5 11e79304bb3abfae27fc897931e5eb19
SHA1 b996e440deae8fb5f57b2bd7c907ed481e0575f5
SHA512 04719dc9f358696d3f110f04b2748d2c01e86b784d0f4738ad28b77f52b166a8081d535ac04eae4cbcf3976bbd6b4d1a58d284a4f29389230ff0bd247fbbba0c
SSDEEP 393216:bQgiCZ+LMZNkhg4V1wKMcEYAJ9s3bFdUl0Ee:bQ5C4LMnF4V1w7Yms3Al4
TLSH
T1EFD62321FAE540B2D4966C7A4582C7348B347E901B166AE77FE81F0F7B54DC16E3222B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects packed executables observed in Molerats 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Loader

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_11e79304bb3abfae27fc897931e5eb19_amadey_darkgate_elex_gcleaner_remcos_smoke-loader_stop

File Explorer

2026-09-29_11e79304bb3abfae27fc897931e5eb19_amadey_darkgate_elex_gcleaner_remcos_smoke-loader_stop

.exe 12.3MB

2026-09-29_11e79304bb3abfae27fc897931e5eb19_amadey_darkgate_elex_gcleaner_remcos_smoke-loader_stop

SHA256 7730ef4fb3a22c08cdaf3d8860dfaae483e5478e3676f1bb506ceaa445242720
MD5 11e79304bb3abfae27fc897931e5eb19
SHA1 b996e440deae8fb5f57b2bd7c907ed481e0575f5
SHA512 04719dc9f358696d3f110f04b2748d2c01e86b784d0f4738ad28b77f52b166a8081d535ac04eae4cbcf3976bbd6b4d1a58d284a4f29389230ff0bd247fbbba0c
SSDEEP 393216:bQgiCZ+LMZNkhg4V1wKMcEYAJ9s3bFdUl0Ee:bQ5C4LMnF4V1w7Yms3Al4
TLSH
T1EFD62321FAE540B2D4966C7A4582C7348B347E901B166AE77FE81F0F7B54DC16E3222B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects packed executables observed in Molerats
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7374832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=93, id=131, productName=VS2008 build 21022, version=21022,

count=11, id=150, version=20413,

count=67, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=31, id=10, version=8447,

count=127, id=132, productName=VS2008 build 21022, version=21022,

count=17, id=109, productName=VS2005 build 50727, version=50727,

count=44, id=123, productName=VS2005 build 50727, version=50727,

count=7, productName=Unmarked objects (old),

count=5, id=49, version=9044,

count=75, id=48, version=9044,

count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1106, id=1, productName=Unmarked objects,

count=251, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=809, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_11e79304bb3abfae27fc897931e5eb19_amadey_darkgate_elex_gcleaner_remcos_smoke-loader_stop

generic