General
- Target 2026-09-09_d4a9785821c9051f3c67aeb8c9acb43b_amadey_darkgate_elex_remcos_smoke-loader_stop_swisyn
- Size 510KB
- Sample260909-nfkvvswscw
- SHA256 fcb6f373b97359e9924b652a0f3c7371f8716c7fffd2cba06c91480bc5fa31f6
- MD5 d4a9785821c9051f3c67aeb8c9acb43b
- SHA1 8aa2e89a58d7e602b00d57dcf33c208a16c67121
- SHA512 c0a24856764ec55e989d1cd4fefe1b8fd30d54273309bd11621343e9e8846604b25ed7bd892f742e2b7a0e865ae247786bfce408de2116555cccd03e886c5a7a
- SSDEEP 12288:PFUNDaeSFMlkXTWpvmaMByhopIaCbiTdbGFX:PFOaesYmkmaMj1Cb8NGFX
- TLSH T159B48C127B90D036C26265B149A6E775BA7E7D311F618A8737D03B2C6E70283BA7431F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-09_d4a9785821c9051f3c67aeb8c9acb43b_amadey_darkgate_elex_remcos_smoke-loader_stop_swisyn.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-09_d4a9785821c9051f3c67aeb8c9acb43b_amadey_darkgate_elex_remcos_smoke-loader_stop_swisyn.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-09_d4a9785821c9051f3c67aeb8c9acb43b_amadey_darkgate_elex_remcos_smoke-loader_stop_swisyn
- Size 510KB
- SHA256 fcb6f373b97359e9924b652a0f3c7371f8716c7fffd2cba06c91480bc5fa31f6
- MD5 d4a9785821c9051f3c67aeb8c9acb43b
- SHA1 8aa2e89a58d7e602b00d57dcf33c208a16c67121
- SHA512 c0a24856764ec55e989d1cd4fefe1b8fd30d54273309bd11621343e9e8846604b25ed7bd892f742e2b7a0e865ae247786bfce408de2116555cccd03e886c5a7a
- SSDEEP 12288:PFUNDaeSFMlkXTWpvmaMByhopIaCbiTdbGFX:PFOaesYmkmaMj1Cb8NGFX
- TLSH T159B48C127B90D036C26265B149A6E775BA7E7D311F618A8737D03B2C6E70283BA7431F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory