General
- Target 2026-08-15_5ec8b6fcb744b933acd70fdd9d0be42c_amadey_darkgate_elex_redline-stealer_smoke-loader_stealc
- Size 4.2MB
- Sample260815-m84m1afd35
- SHA256 798715b7eadcf5ffdec4180f11df7fe8a68beb737a02c1448346eb80f05bba17
- MD5 5ec8b6fcb744b933acd70fdd9d0be42c
- SHA1 4f8c4d0ac1c9068a4d4e51505f18e130cab74cbf
- SHA512 9be1f9488e55e733d4a9c2ffc1d758395af8563c64bdf08e31ceb9572503b54ded25f07faab5fa8c05a267109207761e85d649e9b32d321b3fc4fede22e60e6f
- SSDEEP 98304:/nAQff5+yN0EDi026vPOLGxJJJG65CvuqapPa1zm5GruKx48LvqR9wer9i:/L5T1PpJy65CvuH0h0HjkvqR9werM
- TLSH T18816F1367AB2D036D73231309699A37AE6BDB9309B7842D727D01D3C2E615C2953C26F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_5ec8b6fcb744b933acd70fdd9d0be42c_amadey_darkgate_elex_redline-stealer_smoke-loader_stealc.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_5ec8b6fcb744b933acd70fdd9d0be42c_amadey_darkgate_elex_redline-stealer_smoke-loader_stealc.exe
Resource
win11ltsc2024-20260709-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-15_5ec8b6fcb744b933acd70fdd9d0be42c_amadey_darkgate_elex_redline-stealer_smoke-loader_stealc
- Size 4.2MB
- SHA256 798715b7eadcf5ffdec4180f11df7fe8a68beb737a02c1448346eb80f05bba17
- MD5 5ec8b6fcb744b933acd70fdd9d0be42c
- SHA1 4f8c4d0ac1c9068a4d4e51505f18e130cab74cbf
- SHA512 9be1f9488e55e733d4a9c2ffc1d758395af8563c64bdf08e31ceb9572503b54ded25f07faab5fa8c05a267109207761e85d649e9b32d321b3fc4fede22e60e6f
- SSDEEP 98304:/nAQff5+yN0EDi026vPOLGxJJJG65CvuqapPa1zm5GruKx48LvqR9wer9i:/L5T1PpJy65CvuH0h0HjkvqR9werM
- TLSH T18816F1367AB2D036D73231309699A37AE6BDB9309B7842D727D01D3C2E615C2953C26F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
UPX dump on OEP (original entry point)
-
Adds Run key to start application
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.