General
- Target 2026-07-20_2d5b40957c40cd2e78214b6a9bb71112_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop
- Size 344KB
- Sample260720-tk9yfafx8j
- SHA256 cc50af7d218e387e146cdb9b2e57c36ae09b7455224b94b0ad0a72b1995c732b
- MD5 2d5b40957c40cd2e78214b6a9bb71112
- SHA1 1e3b0c5b634b17e1516d7aecbcd6ff88f5929d68
- SHA512 4e3d1e1856bd36f3fe897e2dca30f50d6bcd479a1285f0f90e1679d7e1bea1252d768b07290de432d9be68056513c19dc7a855158295d931f3f331c87e30df9e
- SSDEEP 6144:iD3IUG5fdVlWOYMx24lkmYL32BJP3gb7KvUbR1y9mmXgHHHu:i7IU1OYMrlkmYz2B0V4
- TLSH T15E74AE1176E0C837E1B324710DADC7646A69B8715A21C28F7BD1272FAE307D2DA3572B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_2d5b40957c40cd2e78214b6a9bb71112_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_2d5b40957c40cd2e78214b6a9bb71112_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_2d5b40957c40cd2e78214b6a9bb71112_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop
- Size 344KB
- SHA256 cc50af7d218e387e146cdb9b2e57c36ae09b7455224b94b0ad0a72b1995c732b
- MD5 2d5b40957c40cd2e78214b6a9bb71112
- SHA1 1e3b0c5b634b17e1516d7aecbcd6ff88f5929d68
- SHA512 4e3d1e1856bd36f3fe897e2dca30f50d6bcd479a1285f0f90e1679d7e1bea1252d768b07290de432d9be68056513c19dc7a855158295d931f3f331c87e30df9e
- SSDEEP 6144:iD3IUG5fdVlWOYMx24lkmYL32BJP3gb7KvUbR1y9mmXgHHHu:i7IU1OYMrlkmYz2B0V4
- TLSH T15E74AE1176E0C837E1B324710DADC7646A69B8715A21C28F7BD1272FAE307D2DA3572B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory