General
- Target 2026-08-06_fafecc865ac4c64f1e64f878da9c7825_amadey_darkgate_elex_icedid_quasar-rat_stealc_vidar
- Size 27.6MB
- Sample260806-xpgn8sssc1
- SHA256 22673cc8c77c8900517c122d7de6a960cb44fce18c9cd90d7407b2b465c4222f
- MD5 fafecc865ac4c64f1e64f878da9c7825
- SHA1 772a1ad507f1e33d8504d16cc4b28bfb520661c6
- SHA512 e5327b5c97380b5c27c7c03aa29fa2564811ae11e2d88cc0eb6b73f951b8f44d15f3e2a09dfad0b773c3086b731f418cb11f34c3f3f71f8b717c74e0745b8813
- SSDEEP 393216:pYetkaQgsbY+WDuv0cn/w8FBqQxFIma7L05W3tyu5jR5/meer/bkdS:+GxTsbANzTVm7W3ouVbueMv
- TLSH T165570212B65084A8D0A74378D2AA9777E6757C0047A097C712D4BE6E3F33BD26E3B352
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-06_fafecc865ac4c64f1e64f878da9c7825_amadey_darkgate_elex_icedid_quasar-rat_stealc_vidar.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_fafecc865ac4c64f1e64f878da9c7825_amadey_darkgate_elex_icedid_quasar-rat_stealc_vidar.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-06_fafecc865ac4c64f1e64f878da9c7825_amadey_darkgate_elex_icedid_quasar-rat_stealc_vidar
- Size 27.6MB
- SHA256 22673cc8c77c8900517c122d7de6a960cb44fce18c9cd90d7407b2b465c4222f
- MD5 fafecc865ac4c64f1e64f878da9c7825
- SHA1 772a1ad507f1e33d8504d16cc4b28bfb520661c6
- SHA512 e5327b5c97380b5c27c7c03aa29fa2564811ae11e2d88cc0eb6b73f951b8f44d15f3e2a09dfad0b773c3086b731f418cb11f34c3f3f71f8b717c74e0745b8813
- SSDEEP 393216:pYetkaQgsbY+WDuv0cn/w8FBqQxFIma7L05W3tyu5jR5/meer/bkdS:+GxTsbANzTVm7W3ouVbueMv
- TLSH T165570212B65084A8D0A74378D2AA9777E6757C0047A097C712D4BE6E3F33BD26E3B352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing possible sandbox analysis VM usernames
-
Detects executables manipulated with Fody
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.