General
- Target 2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop
- Size 3.0MB
- Sample260605-pddjfaew5s
- SHA256 14635fa0948b03d6ffb4e86446fe413848803a4fd193298a96974a02dd1915ec
- MD5 3fb3ec298e4018dc94abec860aac4134
- SHA1 3229c88337f67fd7f22bb3ef0beba69842af7604
- SHA512 b016d7e65bb827bac20b1341bd1b076ee25982c766af4c0f1584247440ef516181b0b16b94a6cae1d855d1f8ad8ab87cc051a6f1159bdf47aaa8674f1af52dca
- SSDEEP 49152:Vu/dUpCw4SIjcP0idTfTXE5JJ7g97K8Ls6:Vg4midTSJIB
- TLSH T17BE56D13BAC4243AC0AB163A8477A7589D3FBA612B56CD9F57F4484C8E351803E3A75F
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
Resource
win11-20260513-en
Malware Config
Targets
-
- Target 2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop
- Size 3.0MB
- SHA256 14635fa0948b03d6ffb4e86446fe413848803a4fd193298a96974a02dd1915ec
- MD5 3fb3ec298e4018dc94abec860aac4134
- SHA1 3229c88337f67fd7f22bb3ef0beba69842af7604
- SHA512 b016d7e65bb827bac20b1341bd1b076ee25982c766af4c0f1584247440ef516181b0b16b94a6cae1d855d1f8ad8ab87cc051a6f1159bdf47aaa8674f1af52dca
- SSDEEP 49152:Vu/dUpCw4SIjcP0idTfTXE5JJ7g97K8Ls6:Vg4midTSJIB
- TLSH T17BE56D13BAC4243AC0AB163A8477A7589D3FBA612B56CD9F57F4484C8E351803E3A75F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10Modifies WinLogon for persistence
Modifies visibility of hidden/system files in Explorer
UAC bypass
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Adds Run key to start application
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
5