> Family · esmk-crypter-loader_

~/packetpursuit $ cat /intel/families/esmk-crypter-loader.md

typeentityconfidencemediumcreated2026-06-15updated2026-06-15malware-familyloadercrypterpemingwobfuscationcode-injection

esmk-crypter-loader

Custom MinGW-w64 crypter/loader family identified by the internal debug string "ESMK allocated new buffer, freeing old one." The binary is a self-contained reflective PE loader: it extracts, decodes, decrypts, and decompresses an embedded payload from its own .rsrc section, then maps and executes it in memory without touching disk.

Build Stack

  • Compiler: MinGW-w64 GCC 15.2.0 (Brecht Sanders build, r7) ^[raw/analyses/3dc65c75/strings.txt:280-300]
  • Linker: ld 2.46 (implied by PE optional header) ^[pefile.txt]
  • Stripped: Yes; external PDB reference only
  • Architecture: x64 PE32+, ASLR/NX-compatible

Observed Pipeline

  1. Resource extraction — FindResourceA(0, 0x65, 0x0a) locks ~185 KB blob from .rsrc
  2. Nibble decode — high/low nibble swap reduces entropy before decryption
  3. Algorithm-selectable decryption — algorithmID derived from two embedded constants (0x6a0f51f7, 0x3507a1d7) masked with 0x1f
  4. LZSS/XZ decompression — custom engine using CRC-64 variant constant 0xcf1bbcdcbb000000
  5. Reflective PE mapping — VirtualAlloc + section copy + import resolution + RtlAddFunctionTable + entry-point transfer in RWX memory

See nibble-encoded-resource-payload and lzss-xz-embedded-decompressor for technique details.

Anti-Analysis

  • Byte gate at 0x140026043 vs 0x31; mismatch → MessageBoxA("Invalid DOS signature") → abort
  • Anti-debug gate: XOR of VirtualAlloc base with GetCurrentProcessId / GetCurrentThreadId / GetTickCount, compared against 0xffff
  • Control-flow flattening via state machine at fcn.140001f00 (8-case switch, seed 0x1a83e4a0)

Distribution

OpenCTI tags dropped-by-gcleaner and mix5.file place this sample in the gcleaner multi-payload distribution cluster. The MinGW-w64 build is distinct from the Delphi/.NET droppers historically associated with that label — same distribution-vs-family mismatch observed in other gcleaner-tagged MSVC builds (e.g. unclassified-pe32-clipper).

Notable Analyses

  • /intel/analyses/3dc65c75a559b15e60f09abfbdb1d4399cda6dc4134a793930d90e21d4ceebe3.html — First observed sample (this analysis)

Capabilities

  • resource-payload-extraction
  • nibble-encoded-secondary-payload
  • algorithm-selectable-decryption
  • lzss-xz-decompression
  • reflective-pe-loader
  • control-flow-flattening-native-c
  • anti-debug-fingerprint-gate
  • anti-tamper-byte-gate
  • rwx-memory-allocation
  • no-disk-touch-payload-execution

References

  • OpenCTI labels: gcleaner, dropped-by-gcleaner, mix5.file