General
- Target 2026-07-04_da72158694b0088107029797f9ce6078_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop
- Size 345KB
- Sample260704-rw6daacs4p
- SHA256 9448115b0576de03252e7a61d00a7dae2e0b9e774d0e62eb787a28fa05589925
- MD5 da72158694b0088107029797f9ce6078
- SHA1 0c291475b3b08410ce28a10ded877d45b5f4fd84
- SHA512 f13998f3f4bde3759b5d9b8be9a542bfac2b705c2224e8780b905e36dfe27fbf1c6cbee4ca0ffe358a789fbfce30f76cd53e1e0b69fe2d296b4812210c335ede
- SSDEEP 6144:9D3IUG5fdVlWOYMx24lkmYL32BJP3gb7KvUbR1y9mgxI7:97IU1OYMrlkmYz2B0VgS7
- TLSH T17374AD1176E0C837E2B32471096DC7646AA9B8705E25C24F77D1276FAE307D2CA3672B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-04_da72158694b0088107029797f9ce6078_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-04_da72158694b0088107029797f9ce6078_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win11ltsc2024-20260630-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-04_da72158694b0088107029797f9ce6078_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop
- Size 345KB
- SHA256 9448115b0576de03252e7a61d00a7dae2e0b9e774d0e62eb787a28fa05589925
- MD5 da72158694b0088107029797f9ce6078
- SHA1 0c291475b3b08410ce28a10ded877d45b5f4fd84
- SHA512 f13998f3f4bde3759b5d9b8be9a542bfac2b705c2224e8780b905e36dfe27fbf1c6cbee4ca0ffe358a789fbfce30f76cd53e1e0b69fe2d296b4812210c335ede
- SSDEEP 6144:9D3IUG5fdVlWOYMx24lkmYL32BJP3gb7KvUbR1y9mgxI7:97IU1OYMrlkmYz2B0VgS7
- TLSH T17374AD1176E0C837E2B32471096DC7646AA9B8705E25C24F77D1276FAE307D2CA3672B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory