General
- Target 2026-09-13_17c49941b29d60f4c867ce6ee05c31cc_amadey_darkgate_elex_ipamor_nymaim_rhadamanthys_smoke-loader_stealc_stop
- Size 399KB
- Sample260913-v4j2sstsas
- SHA256 1a2e48d632c3863dcc6df68ccbb654e2d4e94c0e912c730fd896558031568e9f
- MD5 17c49941b29d60f4c867ce6ee05c31cc
- SHA1 d147f58222f86d5e5d38e12740ccd113af124f85
- SHA512 ec22dfc7cd63428d880bf28179507868f158b5553938f22faff8c5d3e020a14d7a58b9a75002c50d45a73967ef470b107fa0648dba470f6ccd4c4d4cc2d8b5fe
- SSDEEP 6144:OoezrKMUgn5fdVlWOYMx24lkmYL32BJP3gb7KvUbR1y9mQ:Ooe3yOYMrlkmYz2B0VQ
- TLSH T1EF948D1175E08437E1B3247649BDCB245AB9B8311B25C1CBB7C52B6EAF317D29A3132B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-13_17c49941b29d60f4c867ce6ee05c31cc_amadey_darkgate_elex_ipamor_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-13_17c49941b29d60f4c867ce6ee05c31cc_amadey_darkgate_elex_ipamor_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-13_17c49941b29d60f4c867ce6ee05c31cc_amadey_darkgate_elex_ipamor_nymaim_rhadamanthys_smoke-loader_stealc_stop
- Size 399KB
- SHA256 1a2e48d632c3863dcc6df68ccbb654e2d4e94c0e912c730fd896558031568e9f
- MD5 17c49941b29d60f4c867ce6ee05c31cc
- SHA1 d147f58222f86d5e5d38e12740ccd113af124f85
- SHA512 ec22dfc7cd63428d880bf28179507868f158b5553938f22faff8c5d3e020a14d7a58b9a75002c50d45a73967ef470b107fa0648dba470f6ccd4c4d4cc2d8b5fe
- SSDEEP 6144:OoezrKMUgn5fdVlWOYMx24lkmYL32BJP3gb7KvUbR1y9mQ:Ooe3yOYMrlkmYz2B0VQ
- TLSH T1EF948D1175E08437E1B3247649BDCB245AB9B8311B25C1CBB7C52B6EAF317D29A3132B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application