General
- Target 2026-05-16_227205928c624f7300c1215366d81e7b_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop_swisyn
- Size 643KB
- Sample260516-twvb5aay2q
- SHA256 b9f7dc5fc16e3d02806b9f68d9ef2507fdc530f13d6e0c2ef992ad1fa79a0071
- MD5 227205928c624f7300c1215366d81e7b
- SHA1 d0978b8f2410e24a98fca880f2229596f95ed5a6
- SHA512 c92fc1f66726eb5d27c619988370cd1b2809715dd368a5a8657fb8807b9595bf9d16b5a12ea1ebe4b01b51fdd545dc12d8b4964df9bc21121a876201040d21f7
- SSDEEP 12288:zFUNDay5j7m7bY95bVvxuWxrrv3bE2Xaq78vODPFagF3:zFOaGOQvxuWxrfE2Xa9vODdagF3
- TLSH T1F0E49E12BB80E03AC1A225B01E66E7797669BE701B749AC373943B7D2E311C27574B1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-16_227205928c624f7300c1215366d81e7b_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop_swisyn.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-16_227205928c624f7300c1215366d81e7b_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop_swisyn.exe
Resource
win11-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-16_227205928c624f7300c1215366d81e7b_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop_swisyn
- Size 643KB
- SHA256 b9f7dc5fc16e3d02806b9f68d9ef2507fdc530f13d6e0c2ef992ad1fa79a0071
- MD5 227205928c624f7300c1215366d81e7b
- SHA1 d0978b8f2410e24a98fca880f2229596f95ed5a6
- SHA512 c92fc1f66726eb5d27c619988370cd1b2809715dd368a5a8657fb8807b9595bf9d16b5a12ea1ebe4b01b51fdd545dc12d8b4964df9bc21121a876201040d21f7
- SSDEEP 12288:zFUNDay5j7m7bY95bVvxuWxrrv3bE2Xaq78vODPFagF3:zFOaGOQvxuWxrfE2Xa9vODdagF3
- TLSH T1F0E49E12BB80E03AC1A225B01E66E7797669BE701B749AC373943B7D2E311C27574B1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory