General
- Target 2026-11-07_b5a600e90565ecc04b98a6a76efe1f5c_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
- Size 42.2MB
- Sample261107-mx7khsbs4v
- SHA256 c076ff69fb04479c945d90fb77d299a7b86419bdfd2dad26424c18a70048f54a
- MD5 b5a600e90565ecc04b98a6a76efe1f5c
- SHA1 ad40772c046eed922e24ed474a79d7d360481d84
- SHA512 f8f80326894b5b98d3b008aaa0053829950aadac403208523250142d3725372f0cbd4f5921fb726439dae5328a55329d6aa53a8fe6ef468a147165f511a11ffc
- SSDEEP 786432:HjEAj6ejzntf5nShfi+6B8O5jnYJIluPAB2PABa4hlh7L47:h6uznttoi1/5jWtP22P2a4g
- TLSH T14BA7F129B740E432C9274E391A0BC2D8D43AFE116D78659B3BB13E0C2BB5F96B535346
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-07_b5a600e90565ecc04b98a6a76efe1f5c_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-07_b5a600e90565ecc04b98a6a76efe1f5c_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
- Size 42.2MB
- SHA256 c076ff69fb04479c945d90fb77d299a7b86419bdfd2dad26424c18a70048f54a
- MD5 b5a600e90565ecc04b98a6a76efe1f5c
- SHA1 ad40772c046eed922e24ed474a79d7d360481d84
- SHA512 f8f80326894b5b98d3b008aaa0053829950aadac403208523250142d3725372f0cbd4f5921fb726439dae5328a55329d6aa53a8fe6ef468a147165f511a11ffc
- SSDEEP 786432:HjEAj6ejzntf5nShfi+6B8O5jnYJIluPAB2PABa4hlh7L47:h6uznttoi1/5jWtP22P2a4g
- TLSH T14BA7F129B740E432C9274E391A0BC2D8D43AFE116D78659B3BB13E0C2BB5F96B535346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Custom signature
UPX dump on OEP (original entry point)
Checks computer location settings
Looks up country code configured in the registry, likely geofence.