General
- Target 2026-06-25_ad4903d993ec79ab0995b5f694ac3ae6_darkgate_elex_gcleaner_ransomlock
- Size 436KB
- Sample260629-y82desex6s
- SHA256 fe2ced13302cbb358e088cb716f9260c615bbaaade75dfa360a3d7c6604b29a9
- MD5 ad4903d993ec79ab0995b5f694ac3ae6
- SHA1 d9b589d93a7c5e5e0e976c496f1216a1849bdc9a
- SHA512 fc7be15ddf10960405789e21e583c659f5427eaef2a0f6512eef1b13b83508232bb8812b421cb34a95173416b3780746da4b8dc495f1884c0fc8e54027b491ea
- SSDEEP 6144:v6yprSU4jpy5cni816631dW1G/vGEn3sNWpuLFd6Fyy6wBboksqAU41zHocbeRtX:yMSU4joci8M6PW1GVFeFd60DFUyhe
- TLSH T13D947D27F6D08437D1A33AB5DC178A98A9257E501D24644A7BFC3E0C4F79383F92629E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-25_ad4903d993ec79ab0995b5f694ac3ae6_darkgate_elex_gcleaner_ransomlock.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-25_ad4903d993ec79ab0995b5f694ac3ae6_darkgate_elex_gcleaner_ransomlock.exe
Resource
win11ltsc2024-20260629-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-25_ad4903d993ec79ab0995b5f694ac3ae6_darkgate_elex_gcleaner_ransomlock
- Size 436KB
- SHA256 fe2ced13302cbb358e088cb716f9260c615bbaaade75dfa360a3d7c6604b29a9
- MD5 ad4903d993ec79ab0995b5f694ac3ae6
- SHA1 d9b589d93a7c5e5e0e976c496f1216a1849bdc9a
- SHA512 fc7be15ddf10960405789e21e583c659f5427eaef2a0f6512eef1b13b83508232bb8812b421cb34a95173416b3780746da4b8dc495f1884c0fc8e54027b491ea
- SSDEEP 6144:v6yprSU4jpy5cni816631dW1G/vGEn3sNWpuLFd6Fyy6wBboksqAU41zHocbeRtX:yMSU4joci8M6PW1GVFeFd60DFUyhe
- TLSH T13D947D27F6D08437D1A33AB5DC178A98A9257E501D24644A7BFC3E0C4F79383F92629E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.