General
- Target 2026-11-01_cc8224014520ac52b82476abb286498b_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_smoke-loader_stop
- Size 47.9MB
- Sample261102-ke8nraee82
- SHA256 52ef323b605dd13f6747097b42e081a97d5ac3107969ac0d53fdafa2c9ffff23
- MD5 cc8224014520ac52b82476abb286498b
- SHA1 8825acec5ee0d0d1862d79a67a9a54dc13b709f5
- SHA512 6df138b7247b7989d79a3ffafe3f4af06b97752d17d82b4efc972100d3ddea9a912a324f52fa91010cf6316916eedb36c571f73bfc37726ed8a6db8e47acdd8d
- SSDEEP 786432:SNVjchuWARCSRpGoHCbrFwMp9H25FtfGhJ4wNvMpZzSPwjs9jNdpS1o0K3:SNVjchuWARLRPinmMeQhJhCV49hG1oB
- TLSH T125B71220368EC43BE62F16B1593D9A6A913C7DA61B7208D773DCBD1916748C32732E27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_cc8224014520ac52b82476abb286498b_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_cc8224014520ac52b82476abb286498b_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260911-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-01_cc8224014520ac52b82476abb286498b_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_smoke-loader_stop
- Size 47.9MB
- SHA256 52ef323b605dd13f6747097b42e081a97d5ac3107969ac0d53fdafa2c9ffff23
- MD5 cc8224014520ac52b82476abb286498b
- SHA1 8825acec5ee0d0d1862d79a67a9a54dc13b709f5
- SHA512 6df138b7247b7989d79a3ffafe3f4af06b97752d17d82b4efc972100d3ddea9a912a324f52fa91010cf6316916eedb36c571f73bfc37726ed8a6db8e47acdd8d
- SSDEEP 786432:SNVjchuWARCSRpGoHCbrFwMp9H25FtfGhJ4wNvMpZzSPwjs9jNdpS1o0K3:SNVjchuWARLRPinmMeQhJhCV49hG1oB
- TLSH T125B71220368EC43BE62F16B1593D9A6A913C7DA61B7208D773DCBD1916748C32732E27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.