General
- Target 2026-03-21_f7dc412e0e2a70fb734a58b8decaa8e1_amadey_darkgate_elex_karagany_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 248KB
- Sample260321-ehpgdshv5r
- SHA256 c53894d392137bbc22448a68202974c57a906888f560c5583dfd09924aafaa81
- MD5 f7dc412e0e2a70fb734a58b8decaa8e1
- SHA1 4331638b84214651154ea10db1998b1f34112b98
- SHA512 4fc3bfa246a09cafd8c25388b1155253a7128adb0304dfb2de1c9b254991baa44b94196480c6952b0ea9e456e145077d973bc208824417815111954f3a787879
- SSDEEP 3072:/7jaMYp8xn7FMW6J1GzMEh4UDaxtmoRpDf3vP2LrN4ZATBNZwituhXsd:/7j8g7FMHiMOtaxtfDPnyrN4Z0o9X
- TLSH T16D447D3231C0C2B5C2A3AA7A48D8F7905E596FD2433430AF5FEA573D0A25BC16975E83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-03-21_f7dc412e0e2a70fb734a58b8decaa8e1_amadey_darkgate_elex_karagany_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-03-21_f7dc412e0e2a70fb734a58b8decaa8e1_amadey_darkgate_elex_karagany_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win11-20260130-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-03-21_f7dc412e0e2a70fb734a58b8decaa8e1_amadey_darkgate_elex_karagany_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 248KB
- SHA256 c53894d392137bbc22448a68202974c57a906888f560c5583dfd09924aafaa81
- MD5 f7dc412e0e2a70fb734a58b8decaa8e1
- SHA1 4331638b84214651154ea10db1998b1f34112b98
- SHA512 4fc3bfa246a09cafd8c25388b1155253a7128adb0304dfb2de1c9b254991baa44b94196480c6952b0ea9e456e145077d973bc208824417815111954f3a787879
- SSDEEP 3072:/7jaMYp8xn7FMW6J1GzMEh4UDaxtmoRpDf3vP2LrN4ZATBNZwituhXsd:/7j8g7FMHiMOtaxtfDPnyrN4Z0o9X
- TLSH T16D447D3231C0C2B5C2A3AA7A48D8F7905E596FD2433430AF5FEA573D0A25BC16975E83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Azorult family
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.