General
- Target 2026-07-01_fecf39a530fa2ddbf80d5f33046d9fa7_amadey_bandook_darkgate_elex_gcleaner_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 3.8MB
- Sample260701-hs7x9saw71
- SHA256 09dcbfcf8b7ecd6a124b60672ed6c088bd141ae22a027857101e1fe395b1c078
- MD5 fecf39a530fa2ddbf80d5f33046d9fa7
- SHA1 662dd38a0944196a4cf46e80ca7484efb3c7d1eb
- SHA512 0c8f4cc95dd875f9d12247fe5cc8778c3badf3f503fb731422ddd53da872448cc29d612ee3d34d824de1facbf5764ae8d6bc74def6ac3d790d6beaaae279521c
- SSDEEP 49152:o1cWu1BQA98s6AFzCtiqCrTP98OpXNHW698h/a6m2:20Fz7nXq/a6l
- TLSH T119067C62F6D0C872D0721634CC6AD7E45A39BD10AE39564F33E9BF1C6E366827C242D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_fecf39a530fa2ddbf80d5f33046d9fa7_amadey_bandook_darkgate_elex_gcleaner_rhadamanthys_smoke.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_fecf39a530fa2ddbf80d5f33046d9fa7_amadey_bandook_darkgate_elex_gcleaner_rhadamanthys_smoke.exe
Resource
win11ltsc2024-20260629-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-01_fecf39a530fa2ddbf80d5f33046d9fa7_amadey_bandook_darkgate_elex_gcleaner_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 3.8MB
- SHA256 09dcbfcf8b7ecd6a124b60672ed6c088bd141ae22a027857101e1fe395b1c078
- MD5 fecf39a530fa2ddbf80d5f33046d9fa7
- SHA1 662dd38a0944196a4cf46e80ca7484efb3c7d1eb
- SHA512 0c8f4cc95dd875f9d12247fe5cc8778c3badf3f503fb731422ddd53da872448cc29d612ee3d34d824de1facbf5764ae8d6bc74def6ac3d790d6beaaae279521c
- SSDEEP 49152:o1cWu1BQA98s6AFzCtiqCrTP98OpXNHW698h/a6m2:20Fz7nXq/a6l
- TLSH T119067C62F6D0C872D0721634CC6AD7E45A39BD10AE39564F33E9BF1C6E366827C242D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.