General
- Target 2026-07-02_b947c71c31a3fb5b660549f1a2fff657_amadey_bkransomware_darkgate_elex_manuscrypt_maze_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 16.8MB
- Sample260702-p5kf3aew8s
- SHA256 bf8a4a3605ee7e1405d12906a8f36bad4f642f3afb9f5f67040e9bce19be7f20
- MD5 b947c71c31a3fb5b660549f1a2fff657
- SHA1 da19bafd2118be406a94b145748228f3f1f5b639
- SHA512 a2926c0d1df7f4acae2f4871791b3992543a8a301deef72738d916983d2f74abefc665c5e9fc664f8e87f7990ded59f446a92f88309eab42f6954c7a295d89ce
- SSDEEP 196608:NSI43vJkcDFqcrlsJ3E3Sds2V35QZHcNpW/S4R67tJfD7:NE3WcDFh3+9pwS4CPX
- TLSH T13D074A1169B2706AC1520131C5D7F27BE574BA2FA73342AF62586B1B093268DFDE7F02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-02_b947c71c31a3fb5b660549f1a2fff657_amadey_bkransomware_darkgate_elex_manuscrypt_maze_redlin.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_b947c71c31a3fb5b660549f1a2fff657_amadey_bkransomware_darkgate_elex_manuscrypt_maze_redlin.exe
Resource
win11ltsc2024-20260629-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_b947c71c31a3fb5b660549f1a2fff657_amadey_bkransomware_darkgate_elex_manuscrypt_maze_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 16.8MB
- SHA256 bf8a4a3605ee7e1405d12906a8f36bad4f642f3afb9f5f67040e9bce19be7f20
- MD5 b947c71c31a3fb5b660549f1a2fff657
- SHA1 da19bafd2118be406a94b145748228f3f1f5b639
- SHA512 a2926c0d1df7f4acae2f4871791b3992543a8a301deef72738d916983d2f74abefc665c5e9fc664f8e87f7990ded59f446a92f88309eab42f6954c7a295d89ce
- SSDEEP 196608:NSI43vJkcDFqcrlsJ3E3Sds2V35QZHcNpW/S4R67tJfD7:NE3WcDFh3+9pwS4CPX
- TLSH T13D074A1169B2706AC1520131C5D7F27BE574BA2FA73342AF62586B1B093268DFDE7F02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Adds Run key to start application
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.