General
- Target 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_stop
- Size 13.5MB
- Sample260814-jgqehsfk3w
- SHA256 3a483c77bf6e91be59808b54d557da6be9c76b140dd5a4b52c27242c1bb51a27
- MD5 789c72e0bec39fbdb46e2c5f1b647767
- SHA1 83d19dddfc41b7dd94f8c9044755d9a6ffd70a22
- SHA512 7d9d1a11eae20f167fd31d65839608fb9f820b73d38a427014de0166f062d51a5005ce521dd1a570f8258d96b1f07550a330a25f7c58e041b1c758099d81e3f3
- SSDEEP 196608:twRjoL2RNRoreGZF6bUpMBF1p/kjRmLeGZF6bUpMBF1p/kjRm4OWi2b0oB:JCQjIbUwF1VERmDIbUwF1VERmj2bLB
- TLSH T126E6F115F6B48335E073C079C5E3D65AEA3238835B3985CB1385AB6D2E376D28A36731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_stop
- Size 13.5MB
- SHA256 3a483c77bf6e91be59808b54d557da6be9c76b140dd5a4b52c27242c1bb51a27
- MD5 789c72e0bec39fbdb46e2c5f1b647767
- SHA1 83d19dddfc41b7dd94f8c9044755d9a6ffd70a22
- SHA512 7d9d1a11eae20f167fd31d65839608fb9f820b73d38a427014de0166f062d51a5005ce521dd1a570f8258d96b1f07550a330a25f7c58e041b1c758099d81e3f3
- SSDEEP 196608:twRjoL2RNRoreGZF6bUpMBF1p/kjRmLeGZF6bUpMBF1p/kjRm4OWi2b0oB:JCQjIbUwF1VERmDIbUwF1VERmj2bLB
- TLSH T126E6F115F6B48335E073C079C5E3D65AEA3238835B3985CB1385AB6D2E376D28A36731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory