General
- Target 2026-08-09_7897b39a30e6da4d35be4db72fac69e8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_manuscrypt_remcos_rhadamanthys_smoke-loader_stop
- Size 8.4MB
- Sample260809-t2lbea1hpa
- SHA256 afb9e294fda2b2511931111dbe65a5c76fb12d0a36b52e39eaf7af9ab9514e8d
- MD5 7897b39a30e6da4d35be4db72fac69e8
- SHA1 9c817c7919ae03dbfb99072859d86fd63e678bf9
- SHA512 c4b0bdad1a6aa178cea3664a71b25be4c813c3e5752702c8fb1959fabc8b189b5ad728319f9b8d66550887dc5bf85d1bc4076496ea8a71b4c230d759bbdb8b0d
- SSDEEP 49152:JxpM84pkc8MNFmrRokpDljBDtoZIeWo3n2bjlJ+MYu8m1/N9IT3S9tsgX8zEC8UL:OfkcsrRokEmZgxK8mzOTIOSAn
- TLSH T170964B13B6B4EC23F27D35FAD8A489241D6D7C3A4AA3B16B317DF65E8B736414A01213
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-09_7897b39a30e6da4d35be4db72fac69e8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_manu.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_7897b39a30e6da4d35be4db72fac69e8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_manuscrypt_remcos_rhadamanthys_smoke-loader_stop
- Size 8.4MB
- SHA256 afb9e294fda2b2511931111dbe65a5c76fb12d0a36b52e39eaf7af9ab9514e8d
- MD5 7897b39a30e6da4d35be4db72fac69e8
- SHA1 9c817c7919ae03dbfb99072859d86fd63e678bf9
- SHA512 c4b0bdad1a6aa178cea3664a71b25be4c813c3e5752702c8fb1959fabc8b189b5ad728319f9b8d66550887dc5bf85d1bc4076496ea8a71b4c230d759bbdb8b0d
- SSDEEP 49152:JxpM84pkc8MNFmrRokpDljBDtoZIeWo3n2bjlJ+MYu8m1/N9IT3S9tsgX8zEC8UL:OfkcsrRokEmZgxK8mzOTIOSAn
- TLSH T170964B13B6B4EC23F27D35FAD8A489241D6D7C3A4AA3B16B317DF65E8B736414A01213
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory