General
- Target 2026-05-11_2a3029598c741844ba8f713bbcb2c82c_amadey_darkgate_elex_redline-stealer_smoke-loader_stealc
- Size 4.7MB
- Sample260511-scaypscx9t
- SHA256 976676e15fe7c2d1b8074f53b9983933984171277a970c8e7e1d671a7c505689
- MD5 2a3029598c741844ba8f713bbcb2c82c
- SHA1 50d5d5c6032881bdd1514378f61bf47de21785ce
- SHA512 2809db0b81aee47f750491f68a2c63cfaf921e1e57f9bf73d3f6c3f335f78127c92efa76ad92f6f048624d16f412998273055eed051044e88c29c7cef7aacda1
- SSDEEP 98304:lnAQff5+yN0EDi026vPOLGxJJJG65CvuqaYGoDdGgbQyDlSih/FFhCX9wQR+XYzt:lL5T1PpJy65CvuH1wdtbQyMKkX9wQR+E
- TLSH T1563601257AA2C076D7323130969AA77AE7BDB9309B7542E727D01D3C2E305C2593C26F
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-11_2a3029598c741844ba8f713bbcb2c82c_amadey_darkgate_elex_redline-stealer_smoke-loader_stealc.exe
Resource
win10v2004-20260130-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-11_2a3029598c741844ba8f713bbcb2c82c_amadey_darkgate_elex_redline-stealer_smoke-loader_stealc
- Size 4.7MB
- SHA256 976676e15fe7c2d1b8074f53b9983933984171277a970c8e7e1d671a7c505689
- MD5 2a3029598c741844ba8f713bbcb2c82c
- SHA1 50d5d5c6032881bdd1514378f61bf47de21785ce
- SHA512 2809db0b81aee47f750491f68a2c63cfaf921e1e57f9bf73d3f6c3f335f78127c92efa76ad92f6f048624d16f412998273055eed051044e88c29c7cef7aacda1
- SSDEEP 98304:lnAQff5+yN0EDi026vPOLGxJJJG65CvuqaYGoDdGgbQyDlSih/FFhCX9wQR+XYzt:lL5T1PpJy65CvuH1wdtbQyMKkX9wQR+E
- TLSH T1563601257AA2C076D7323130969AA77AE7BDB9309B7542E727D01D3C2E305C2593C26F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL