General
- Target 2026-07-08_e65842f3b624578e1a057ee9363025c7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop
- Size 1.5MB
- Sample260708-a1psnahv7p
- SHA256 f486e0177dcb28ae14f18cae2e1a41ea577c5f219795172a113fd07d35aec972
- MD5 e65842f3b624578e1a057ee9363025c7
- SHA1 97bded1ed5e74ef5df66cea6831a41df434734ff
- SHA512 1a9d75a0a66cca70a162c3b91965f8045e496822315bba5644f866b95ea45d7b5a72bea05f0a051ecf89715dac583fe6a3a77c3e580990de4b961d142e143b7d
- SSDEEP 24576:ur0URPEJ0sg+9QqVkpSHeJWGCxf7Gz3Q9At:urxRP9sg+OqVks+JWv50A9
- TLSH T120756C0277F99129F1F37BB1AEB893645A77BC71AD39C50E22C1215E09B4A40DA72733
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_e65842f3b624578e1a057ee9363025c7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_e65842f3b624578e1a057ee9363025c7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260706-en
17 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-08_e65842f3b624578e1a057ee9363025c7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop
- Size 1.5MB
- SHA256 f486e0177dcb28ae14f18cae2e1a41ea577c5f219795172a113fd07d35aec972
- MD5 e65842f3b624578e1a057ee9363025c7
- SHA1 97bded1ed5e74ef5df66cea6831a41df434734ff
- SHA512 1a9d75a0a66cca70a162c3b91965f8045e496822315bba5644f866b95ea45d7b5a72bea05f0a051ecf89715dac583fe6a3a77c3e580990de4b961d142e143b7d
- SSDEEP 24576:ur0URPEJ0sg+9QqVkpSHeJWGCxf7Gz3Q9At:urxRP9sg+OqVks+JWv50A9
- TLSH T120756C0277F99129F1F37BB1AEB893645A77BC71AD39C50E22C1215E09B4A40DA72733
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1