General
- Target 2026-08-08_4c4ad6850ea2c6563f6f9b44af095d43_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
- Size 39.8MB
- Sample260808-wjvs8sbl5v
- SHA256 77b05dd7a05e6169d849aa164e227673cd69b113f7263312fd41e513e501d9ff
- MD5 4c4ad6850ea2c6563f6f9b44af095d43
- SHA1 e23f06afa2fb94834727531bf12bf3bbf336baae
- SHA512 414041349d07b10c71c5d57d3806d33cc37714df59d8c92eea1106dae9307081c1bb78e77d052c57d4aff10c564bd173154ba1d0f715eb8133dabcf05606cced
- SSDEEP 393216:Bc9LJsiiXTbTTqZLKTe6StVPWpGplR8ZqV/U2fykpWQ/ZP9dSg91IF91Ikpu+guU:BAyik+qe62VPWpGpE7wxlALQ
- TLSH T136977C12A7E68161F2B35B30DC3642FE4A27BD55AF3885DF22853E0DA9B13D06839357
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-08_4c4ad6850ea2c6563f6f9b44af095d43_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_4c4ad6850ea2c6563f6f9b44af095d43_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-08_4c4ad6850ea2c6563f6f9b44af095d43_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
- Size 39.8MB
- SHA256 77b05dd7a05e6169d849aa164e227673cd69b113f7263312fd41e513e501d9ff
- MD5 4c4ad6850ea2c6563f6f9b44af095d43
- SHA1 e23f06afa2fb94834727531bf12bf3bbf336baae
- SHA512 414041349d07b10c71c5d57d3806d33cc37714df59d8c92eea1106dae9307081c1bb78e77d052c57d4aff10c564bd173154ba1d0f715eb8133dabcf05606cced
- SSDEEP 393216:Bc9LJsiiXTbTTqZLKTe6StVPWpGplR8ZqV/U2fykpWQ/ZP9dSg91IF91Ikpu+guU:BAyik+qe62VPWpGpE7wxlALQ
- TLSH T136977C12A7E68161F2B35B30DC3642FE4A27BD55AF3885DF22853E0DA9B13D06839357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL