- First seen
- Last seen
THREAT SIGNALHigh
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
05bbc11b2c9f3bb65e7ff0b2d16a31f3163a6d23db117ece29d42e3a8cdd34cf- SHA1
9af93fa3eb20f01a4e3941a06d148d08f23e4b0e- MD5
58c73266263ddf338ed4a2e2d7f2068b- Filename
- 2026-02-05_58c73266263ddf338ed4a2e2d7f2068b_amadey_bandook_darkgate_elex_gcleaner_smoke-loader
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 1825678
- Compile time
- 2029-10-13T15:59:23Z
- PE platform
- x86 32-bit
- PE sections
- 9
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections supports blocking or enrichment review for this indicator.
Detection signal
Malicious. Engine detections are elevated at 88%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections88%
VirusSign confidence100%
Threat classificationstihat
Intelligence freshnessFresh
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
No related intelligence is currently available for this indicator.
Analysis details
Severity: hightrojanfile-overlaybobsoftexeamadeydiscoveryspywareelexpersistencegcleanersigned
Freshness: Fresh · Last seen 1 day ago.
- Detection rate
- 88%
- Threat type
- trojan
- Family
- stihat
- Confidence
- 100%
- detection
- 88 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
05bbc11b2c9f3bb65e7ff0b2d16a31f3163a6d23db117ece29d42e3a8cdd34cf- SHA1
9af93fa3eb20f01a4e3941a06d148d08f23e4b0e- MD5
58c73266263ddf338ed4a2e2d7f2068b- Filename
- 2026-02-05_58c73266263ddf338ed4a2e2d7f2068b_amadey_bandook_darkgate_elex_gcleaner_smoke-loader
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 1825678
- Compile time
- 2029-10-13T15:59:23Z
- PE platform
- x86 32-bit
- PE sections
- 9
- Import libraries
- 10
- TLSH
T1F1857B12B7D4C431E1B306348D3796644937BC516E74899F32AC3A0E6F76BC2A932B5B- SSDEEP
49152:oEs1hS5W/oeMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMM4:oE2hS5WfMMHMMMvMMZMMMlmMMMiMMMY9- Imphash
17ed737e8e77e97fd1eb6ad9ba5d3eae- First seen
- 2026-02-03T17:37:26Z
- Last seen
- 2026-11-10T12:05:21Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections supports blocking or enrichment review for this indicator.
Detection signal
Malicious. Engine detections are elevated at 88%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family stihat.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
Classification context: type trojan, family stihat.
Last seen 1 day ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 2026-02-05_58c73266263ddf338ed4a2e2d7f2068b_amadey_bandook_darkgate_elex_gcleaner_smoke-loader
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 1825678
- Compile time
- 2029-10-13T15:59:23Z
- PE platform
- x86 32-bit
- Entry point
- 380800
- Sections
- 9
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit5+ sections
- Platform: x86 32-bit
- Sections: 5+
- Entry point: present
- Compile time: 2029-10-13T15:59:23Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 380800
- Sections
- 9
- Compile time
- 2029-10-13T15:59:23Z
PE sections5+
5+ sections
- 5+ PE sections
- Common permissions: rw, rwx
- 5+ unique section names
View details · 5 shown
- Name
- CODE
- Virtual address
- 4096
- Virtual size
- 376832
- Raw size
- 376832
- Permissions
- rwx
- Entropy
- 6.52
- Name
- DATA
- Virtual address
- 380928
- Virtual size
- 8192
- Raw size
- 8192
- Permissions
- rw
- Entropy
- 2.8
- Name
- BSS
- Virtual address
- 389120
- Virtual size
- 4096
- Raw size
- 4096
- Permissions
- rw
- Entropy
- 0.0
- Name
- .idata
- Virtual address
- 393216
- Virtual size
- 12288
- Raw size
- 12288
- Permissions
- rw
- Entropy
- 4.32
- Name
- .tls
- Virtual address
- 405504
- Virtual size
- 4096
- Raw size
- 4096
- Permissions
- rw
- Entropy
- 0.0
5 shown
Imports5+
5+ DLL groups
- 5+ import DLL groups
- 5+ imported functions summarized
View details · 5 shown
- Library
- kernel32.dll
- Functions
- CloseHandle, CompareStringA, CopyFileA, CreateEventA, CreateFileA, CreateThread, DeleteCriticalSection, DeleteFileA …
- Library
- user32.dll
- Functions
- ActivateKeyboardLayout, AdjustWindowRectEx, BeginPaint, CallNextHookEx, CallWindowProcA, CharLowerA, CharLowerBuffA, CharNextA …
- Library
- advapi32.dll
- Functions
- RegCloseKey, RegCreateKeyExA, RegFlushKey, RegOpenKeyExA, RegQueryValueExA, RegSetValueExA
- Library
- oleaut32.dll
- Functions
- GetErrorInfo, SafeArrayCreate, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayPtrOfIndex, SysAllocStringLen, SysFreeString, SysReAllocStringLen …
- Library
- version.dll
- Functions
- GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA
5 shown
Resources5+
5+ resources
- 5+ resources
- Resource types: RT_STRING, RT_BITMAP, RT_CURSOR, RT_GROUP_CURSOR, RT_RCDATA
View details · 5 shown
- Type
- RT_CURSOR
- Language
- NEUTRAL
- Type
- RT_BITMAP
- Language
- NEUTRAL
- Type
- RT_ICON
- Language
- CHINESE TRADITIONAL
- Type
- RT_DIALOG
- Language
- NEUTRAL
- Type
- RT_STRING
- Language
- NEUTRAL
5 shown
File certificate
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Certificates5+
4 issuers
- Example subject: Microsoft Windows
- Issued by: Microsoft Windows Production PCA 2011
View details · 5 shown
- Subject
- Microsoft Windows
- Issuer
- Microsoft Windows Production PCA 2011
- Fingerprint
- FF82BC38E1DA5E596DF374C53E3617F7EDA36B06
- Subject
- Microsoft Windows Production PCA 2011
- Issuer
- Microsoft Root Certificate Authority 2010
- Fingerprint
- 580A6F4CC4E4B669B9EBDC1B2B3E087B80D0678D
- Subject
- Microsoft Time-Stamp service
- Issuer
- Microsoft Time-Stamp PCA 2010
- Fingerprint
- C30BBEB5F806DEB0BB459AF1B853B60A66527CF8
- Subject
- Microsoft Time-Stamp PCA 2010
- Issuer
- Microsoft Root Certificate Authority 2010
- Fingerprint
- 2AA752FE64C49ABE82913C463529CF10FF2F04EE
- Subject
- Microsoft Corporation
- Issuer
- Microsoft Code Signing PCA 2010
- Fingerprint
- 914A09C2E02C696AF394048BCB8D95449BCD5B9E
5 shown
Behavior details
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- accept command line arguments
- allocate or change RWX memory
- capture screenshot
- check OS version
- check for time delay via GetTickCount
5 shown
View MITRE ATT&CK details · 5 shown
View MBC details · 5 shown
- C0007 — Allocate MemoryObjectives: OC0002
- E1010 — Application Window DiscoveryObjectives: OB0007
- B0032.020 — Argument ObfuscationObjectives: OB0002
- E1510 — Clipboard ModificationObjectives: OB0008
- E1059 — Command and Scripting InterpreterObjectives: OB0009
5 shown