General
- Target 2026-11-07_af02ef4fea09c53ba7027c1166b5a457_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
- Size 42.2MB
- Sample261107-m646raef77
- SHA256 9ed10cb014a562f4581ebbadf792912f47f4706b76934ae7f684eabba13e4336
- MD5 af02ef4fea09c53ba7027c1166b5a457
- SHA1 cea38d41865a0b1bbffc8e96c7f634c3e6707e76
- SHA512 864da0e85b559dbca6c8e1bb9e98dacfb1e0b1703985bf80e8829cf8d354f77bbe3d8ebb2abe2e38e999ba685b1c41659342f7d3099a39f9dfdd244476052390
- SSDEEP 786432:jjEAj6ejzntf5nShfi+6B8O5jnYJIluPAB2PABa4hlh7Nvq:t6uznttoi1/5jWtP22P2a4W
- TLSH T108A7F129B740E432C9274E391A0BC2D8D43AFE116D78659B3BB13E0C2BB5F96B535346
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-07_af02ef4fea09c53ba7027c1166b5a457_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-07_af02ef4fea09c53ba7027c1166b5a457_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
- Size 42.2MB
- SHA256 9ed10cb014a562f4581ebbadf792912f47f4706b76934ae7f684eabba13e4336
- MD5 af02ef4fea09c53ba7027c1166b5a457
- SHA1 cea38d41865a0b1bbffc8e96c7f634c3e6707e76
- SHA512 864da0e85b559dbca6c8e1bb9e98dacfb1e0b1703985bf80e8829cf8d354f77bbe3d8ebb2abe2e38e999ba685b1c41659342f7d3099a39f9dfdd244476052390
- SSDEEP 786432:jjEAj6ejzntf5nShfi+6B8O5jnYJIluPAB2PABa4hlh7Nvq:t6uznttoi1/5jWtP22P2a4W
- TLSH T108A7F129B740E432C9274E391A0BC2D8D43AFE116D78659B3BB13E0C2BB5F96B535346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Custom signature
UPX dump on OEP (original entry point)
Checks computer location settings
Looks up country code configured in the registry, likely geofence.