General
- Target 2026-08-03_1aec2cc9f92d604a2387d6c444c3f3e9_amadey_darkgate_elex_gcleaner_glassworm_remcos_smoke-loader
- Size 14.3MB
- Sample260804-p5b5pabc22
- SHA256 430bccdeb6cd5f9abbf951160677af628905509abcfb85c188ba3ef7992976d2
- MD5 1aec2cc9f92d604a2387d6c444c3f3e9
- SHA1 1598e7043c94509e4bd9df100a9103c215595b35
- SHA512 9d5b73af9c31a2f5e3a7da34c8a6503aa2fcc9eb8f96f3d430448c4300f127fd4dad05dfe4d8c145ab8a471ec4a0dae4545ecc71001cdcc521a69e918a18332c
- SSDEEP 196608:ui/k7Af30O5Fmu/MuBZ/NiRCMs0kJMAg0kmjFWVzVKEn:ukkM30O5Fp9iEMs0ky1gW3
- TLSH T10CE67D017680CC66D12A273AC8B989A4553B7DA06F3064DF7BCC3D0DAF759C11EB968B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_1aec2cc9f92d604a2387d6c444c3f3e9_amadey_darkgate_elex_gcleaner_glassworm_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_1aec2cc9f92d604a2387d6c444c3f3e9_amadey_darkgate_elex_gcleaner_glassworm_remcos_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_1aec2cc9f92d604a2387d6c444c3f3e9_amadey_darkgate_elex_gcleaner_glassworm_remcos_smoke-loader
- Size 14.3MB
- SHA256 430bccdeb6cd5f9abbf951160677af628905509abcfb85c188ba3ef7992976d2
- MD5 1aec2cc9f92d604a2387d6c444c3f3e9
- SHA1 1598e7043c94509e4bd9df100a9103c215595b35
- SHA512 9d5b73af9c31a2f5e3a7da34c8a6503aa2fcc9eb8f96f3d430448c4300f127fd4dad05dfe4d8c145ab8a471ec4a0dae4545ecc71001cdcc521a69e918a18332c
- SSDEEP 196608:ui/k7Af30O5Fmu/MuBZ/NiRCMs0kJMAg0kmjFWVzVKEn:ukkM30O5Fp9iEMs0ky1gW3
- TLSH T10CE67D017680CC66D12A273AC8B989A4553B7DA06F3064DF7BCC3D0DAF759C11EB968B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.