Extracted

• • Target
    2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader
  • Size 515KB
  • SHA256 567a7368b1da5e3c887a0e2610f505835f2e6861a2276fc674e68db38e6cb671
  • MD5 6f79845f18e3ee694cfca390daa06263
  • SHA1 fe87cb2b3a42f0897bdcd076d201b96afc1c1a42
  • SHA512 06392e6b9c3990d16f79a22a15a678de7bb1c2e43ab16a78a7be8719ad5232aa4b2fa9efc4affc5c0c68fafb9ea50ac796cabe312f4deaeb1346aeb826158245
  • SSDEEP 12288:egRtI9FsQBmrCYmxuPY98Cmm1JwaIC3WEc:eiGmrVmxuPnCXztWJ
  • TLSH
    T19EB49E11E660D233D47650B4CBF9C323A928BE716B0058E7A3D95FA71F355E2A930B1B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondarkvisionpersistencerat

  • DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision

  • Darkvision family

    darkvision

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion

  • Adds Run key to start application

    persistence
  behavioral1behavioral2