General
- Target 2026-10-26_5ddf80edcd8ad5b17fe7a2aa8fdf9a7b_darkgate_elex_gcleaner_glassworm_installmonster_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 10.1MB
- Sample261027-tvdyraea47
- SHA256 4d4efe6960366d017b45324ceea70947905be456577315299e39dade7700f298
- MD5 5ddf80edcd8ad5b17fe7a2aa8fdf9a7b
- SHA1 e80a9489da909081fdd9a8a27e47bd1a78a21ca3
- SHA512 97d2c77752490dc40b13e31ec3c468534f8f1fb469403ac02e39feb82761906df7d8562e4a5cc581864c04d27a4dca66741ea5db2e2db9298ec565106fd607ca
- SSDEEP 98304:5itMhSynsKR+1DdxLGqK5B1afhEeUwBJqw/757KiVQlx3F/k0V4ZFvfUkFtuVsT7:I0eUUD7PD+9RjlIyi7t
- TLSH T102B65A13B285613FE06B1A3B497BC550AC3B7B712E128C1B6BE4194C8F356816E3E75B
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-26_5ddf80edcd8ad5b17fe7a2aa8fdf9a7b_darkgate_elex_gcleaner_glassworm_installmonster_rhadaman.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-26_5ddf80edcd8ad5b17fe7a2aa8fdf9a7b_darkgate_elex_gcleaner_glassworm_installmonster_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 10.1MB
- SHA256 4d4efe6960366d017b45324ceea70947905be456577315299e39dade7700f298
- MD5 5ddf80edcd8ad5b17fe7a2aa8fdf9a7b
- SHA1 e80a9489da909081fdd9a8a27e47bd1a78a21ca3
- SHA512 97d2c77752490dc40b13e31ec3c468534f8f1fb469403ac02e39feb82761906df7d8562e4a5cc581864c04d27a4dca66741ea5db2e2db9298ec565106fd607ca
- SSDEEP 98304:5itMhSynsKR+1DdxLGqK5B1afhEeUwBJqw/757KiVQlx3F/k0V4ZFvfUkFtuVsT7:I0eUUD7PD+9RjlIyi7t
- TLSH T102B65A13B285613FE06B1A3B497BC550AC3B7B712E128C1B6BE4194C8F356816E3E75B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE