General
- Target 2026-07-06_b0d908424f1097b303b85240c0cd1bf3_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader
- Size 14.7MB
- Sample260707-bxveeact8k
- SHA256 5ec9d7ca26e98df4c96fb71caff95df9f029ca78ec51b10cca54811a90138097
- MD5 b0d908424f1097b303b85240c0cd1bf3
- SHA1 b4c752216c7ba3c7ae99334d435eb85e124f1a38
- SHA512 38aa30b509a599b8fd8a8d2513353cef8aa2a564586233b03569ea6b792dc249e3bde3cf5a570f28fba414f264324478c29c006a3b57f9bf22c372471af299ad
- SSDEEP 393216:MnwnKWfrbvRXw+T2WPnoY4smJ62mWC08ohD:M4JXw62oneEaD
- TLSH T132F67D21E7D64070F5B30A709976A27A8A77BE300832CC9FB24C5D4D5BB7DC2896572B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_b0d908424f1097b303b85240c0cd1bf3_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-06_b0d908424f1097b303b85240c0cd1bf3_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader
- Size 14.7MB
- SHA256 5ec9d7ca26e98df4c96fb71caff95df9f029ca78ec51b10cca54811a90138097
- MD5 b0d908424f1097b303b85240c0cd1bf3
- SHA1 b4c752216c7ba3c7ae99334d435eb85e124f1a38
- SHA512 38aa30b509a599b8fd8a8d2513353cef8aa2a564586233b03569ea6b792dc249e3bde3cf5a570f28fba414f264324478c29c006a3b57f9bf22c372471af299ad
- SSDEEP 393216:MnwnKWfrbvRXw+T2WPnoY4smJ62mWC08ohD:M4JXw62oneEaD
- TLSH T132F67D21E7D64070F5B30A709976A27A8A77BE300832CC9FB24C5D4D5BB7DC2896572B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.