General
- Target 2026-07-05_5f0af2c8ce59b4f3bc785c2bda8739cc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop_swisyn
- Size 642KB
- Sample260705-ntvxzsb17v
- SHA256 022be988847a39fe31aa15226d27c6853df50e6848eab9c2c00357b17061829e
- MD5 5f0af2c8ce59b4f3bc785c2bda8739cc
- SHA1 b44d2f988391019e0d988e537a2e5ba7ebc61d32
- SHA512 e7838064cd2608ac9f55db7d84d970f115dc34e1c8f6b98e8670e03e53ca5657dc3149ba4bf57b96eac0439d373f46bd8bea55cdab76b24164f88a5fdf44a1bc
- SSDEEP 12288:cFUNDaDKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK+:cFOaDKKKKKKKKKKKKKKKKKKKKKKKKKKy
- TLSH T186E49E12BB80D436C16265B01EA6E7B97A7ABE311B749AC373943B7D2E311C2753470B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-05_5f0af2c8ce59b4f3bc785c2bda8739cc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop_swisyn.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_5f0af2c8ce59b4f3bc785c2bda8739cc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop_swisyn.exe
Resource
win11ltsc2024-20260629-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-05_5f0af2c8ce59b4f3bc785c2bda8739cc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop_swisyn
- Size 642KB
- SHA256 022be988847a39fe31aa15226d27c6853df50e6848eab9c2c00357b17061829e
- MD5 5f0af2c8ce59b4f3bc785c2bda8739cc
- SHA1 b44d2f988391019e0d988e537a2e5ba7ebc61d32
- SHA512 e7838064cd2608ac9f55db7d84d970f115dc34e1c8f6b98e8670e03e53ca5657dc3149ba4bf57b96eac0439d373f46bd8bea55cdab76b24164f88a5fdf44a1bc
- SSDEEP 12288:cFUNDaDKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK+:cFOaDKKKKKKKKKKKKKKKKKKKKKKKKKKy
- TLSH T186E49E12BB80D436C16265B01EA6E7B97A7ABE311B749AC373943B7D2E311C2753470B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory