General
- Target 2026-07-01_db872e0f7fd7df84633956352429a0a6_amadey_darkgate_elex_redline-stealer_smoke-loader_stealc
- Size 11.2MB
- Sample260701-1zcd2se17k
- SHA256 dc6f892125b4fddcbb6e5232462db4896d72c8396610cf7f61bf68cb35831635
- MD5 db872e0f7fd7df84633956352429a0a6
- SHA1 ff254d0bdc0db97f2967f0b564589e1dcbf3c2b5
- SHA512 723013d253dfd4ca4ded506af08da422021de6b4c7a3aaee24498d6bce1260263f0ff84d2df6186edfb2faea08ff2e4634eeb769050a4b3d822f28d646cb65c0
- SSDEEP 196608:9L5T1PpJy65CvuH1h0HjkvqI9wj+3wjyX7zmteyOt9BmnFMIke3WDZYAF/wpjkmS:btpJ1yjjZ+3wjyX7oeyOFmFMIkeGDZYu
- TLSH T124C622357AA28076D3723230969DA37AE7B9B9705F74529716D01E3C2D706C29A3C32F
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-01_db872e0f7fd7df84633956352429a0a6_amadey_darkgate_elex_redline-stealer_smoke-loader_stealc.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-01_db872e0f7fd7df84633956352429a0a6_amadey_darkgate_elex_redline-stealer_smoke-loader_stealc
- Size 11.2MB
- SHA256 dc6f892125b4fddcbb6e5232462db4896d72c8396610cf7f61bf68cb35831635
- MD5 db872e0f7fd7df84633956352429a0a6
- SHA1 ff254d0bdc0db97f2967f0b564589e1dcbf3c2b5
- SHA512 723013d253dfd4ca4ded506af08da422021de6b4c7a3aaee24498d6bce1260263f0ff84d2df6186edfb2faea08ff2e4634eeb769050a4b3d822f28d646cb65c0
- SSDEEP 196608:9L5T1PpJy65CvuH1h0HjkvqI9wj+3wjyX7zmteyOt9BmnFMIke3WDZYAF/wpjkmS:btpJ1yjjZ+3wjyX7oeyOFmFMIkeGDZYu
- TLSH T124C622357AA28076D3723230969DA37AE7B9B9705F74529716D01E3C2D706C29A3C32F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL