General
- Target 2026-05-24_d9cebc60eb86fe1569e8d09fe4069029_darkgate_elex_smoke-loader
- Size 2.2MB
- Sample260524-28fcqsct6v
- SHA256 1c63323e4cf137b58b3731484f97f2f4c463b0009df972ddbb00897e5c23c2a9
- MD5 d9cebc60eb86fe1569e8d09fe4069029
- SHA1 85e6b907e48a87c4c7dc7be9e898e15a53ab2b5c
- SHA512 60bee6004b9fd1d955033f5dfcb10eb6c3638522f7a14c80a7f2fe403d2d36b940de2f80471653e4830e200809c97e7052b5b81107113b46072f8111fba4ee0e
- SSDEEP 49152:tmgqWDlmt+OCi1NqvNgyhIZ0tFYh1W1rJ/c8cifaE9+WagVGhUETtHWSQLQRQucH:pqimt+Ov1eNgyhIZ0tFYh1QrpaE97agB
- TLSH T14AA5BF2A36A18076CA3339314A4DF3B9F6B9AD704935022767A03E3C2E715935D2977F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-05-24_d9cebc60eb86fe1569e8d09fe4069029_darkgate_elex_smoke-loader.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
112.175.88.207
-
112.175.88.208
Targets
-
- Target 2026-05-24_d9cebc60eb86fe1569e8d09fe4069029_darkgate_elex_smoke-loader
- Size 2.2MB
- SHA256 1c63323e4cf137b58b3731484f97f2f4c463b0009df972ddbb00897e5c23c2a9
- MD5 d9cebc60eb86fe1569e8d09fe4069029
- SHA1 85e6b907e48a87c4c7dc7be9e898e15a53ab2b5c
- SHA512 60bee6004b9fd1d955033f5dfcb10eb6c3638522f7a14c80a7f2fe403d2d36b940de2f80471653e4830e200809c97e7052b5b81107113b46072f8111fba4ee0e
- SSDEEP 49152:tmgqWDlmt+OCi1NqvNgyhIZ0tFYh1W1rJ/c8cifaE9+WagVGhUETtHWSQLQRQucH:pqimt+Ov1eNgyhIZ0tFYh1QrpaE97agB
- TLSH T14AA5BF2A36A18076CA3339314A4DF3B9F6B9AD704935022767A03E3C2E715935D2977F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE