General
- Target 2026-11-07_3b6575b6eeb11ffd5ed92d94e17a6323_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
- Size 38.3MB
- Sample261107-sm5aasfc35
- SHA256 e9e000a85fe5b8b2bf64ec3e50d36f0b0d822f904ae9f7be1b05220d655a72d6
- MD5 3b6575b6eeb11ffd5ed92d94e17a6323
- SHA1 80534d89d3e35d010fcdb6cf8394dec80f4a5fc6
- SHA512 4e226caaffec4380a3bc9ef5713257ee13f513fe0483a6388ddb6d617a5f01d35d708ccd3a06cd91c54ee5c74df81cab68c77d6ecb402717cf6cbeade7a4498a
- SSDEEP 786432:5jaZPUSPQWPDiVwDBsVZ15nShfi+6B8O5jnYJIlePAB2PABh:EJUSPQMDiVwDBsVJoi1/5jWjP22P2h
- TLSH T1E297E129B740D432C6174E39290BC2E8D436FE116D78699B3BB13E0C2BF5B96B539346
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-07_3b6575b6eeb11ffd5ed92d94e17a6323_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-07_3b6575b6eeb11ffd5ed92d94e17a6323_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
- Size 38.3MB
- SHA256 e9e000a85fe5b8b2bf64ec3e50d36f0b0d822f904ae9f7be1b05220d655a72d6
- MD5 3b6575b6eeb11ffd5ed92d94e17a6323
- SHA1 80534d89d3e35d010fcdb6cf8394dec80f4a5fc6
- SHA512 4e226caaffec4380a3bc9ef5713257ee13f513fe0483a6388ddb6d617a5f01d35d708ccd3a06cd91c54ee5c74df81cab68c77d6ecb402717cf6cbeade7a4498a
- SSDEEP 786432:5jaZPUSPQWPDiVwDBsVZ15nShfi+6B8O5jnYJIlePAB2PABh:EJUSPQMDiVwDBsVJoi1/5jWjP22P2h
- TLSH T1E297E129B740D432C6174E39290BC2E8D436FE116D78699B3BB13E0C2BF5B96B539346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Custom signature
UPX dump on OEP (original entry point)
Checks computer location settings
Looks up country code configured in the registry, likely geofence.