General
- Target 2026-08-19_087b914ed42cb0af92d3942299e7be49_amadey_darkgate_datper_elex_gcleaner_glassworm_remcos_smoke-loader_stop
- Size 4.6MB
- Sample260820-a162yaxbmf
- SHA256 7b8c3edb6aa74886f04d60ea9b76792fb9b26e9afd78b87b1d88bc5b0659046e
- MD5 087b914ed42cb0af92d3942299e7be49
- SHA1 e04e617243fbc30fc66637da93fcb1114fc7383d
- SHA512 47ea0ffad32a996394fecdc76f97b2c32107b2b8da2c40894abedc5203448e5dfce3c5ce8e2381800a55283f32bb34cac60d5409c44d867f32641f199205fdcf
- SSDEEP 98304:Vg4midTSJvhOYcMgMICb8CWRxJc6qPFdAV:xvsJyCH4e6
- TLSH T1CE268D23BAC0543AC0B71635856BA368A93FB6712B76898F17E00D6C8E351817E3D75F
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-19_087b914ed42cb0af92d3942299e7be49_amadey_darkgate_datper_elex_gcleaner_glassworm_remcos_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-08-19_087b914ed42cb0af92d3942299e7be49_amadey_darkgate_datper_elex_gcleaner_glassworm_remcos_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-08-19_087b914ed42cb0af92d3942299e7be49_amadey_darkgate_datper_elex_gcleaner_glassworm_remcos_smoke-loader_stop
- Size 4.6MB
- SHA256 7b8c3edb6aa74886f04d60ea9b76792fb9b26e9afd78b87b1d88bc5b0659046e
- MD5 087b914ed42cb0af92d3942299e7be49
- SHA1 e04e617243fbc30fc66637da93fcb1114fc7383d
- SHA512 47ea0ffad32a996394fecdc76f97b2c32107b2b8da2c40894abedc5203448e5dfce3c5ce8e2381800a55283f32bb34cac60d5409c44d867f32641f199205fdcf
- SSDEEP 98304:Vg4midTSJvhOYcMgMICb8CWRxJc6qPFdAV:xvsJyCH4e6
- TLSH T1CE268D23BAC0543AC0B71635856BA368A93FB6712B76898F17E00D6C8E351817E3D75F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Modifies visibility of hidden/system files in Explorer
-
UAC bypass
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
5