General
- Target 2026-11-06_fa2a2cfac4fbe98f0f94ce939a9d3e49_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
- Size 38.3MB
- Sample261107-wvddbsdz2v
- SHA256 08a8cfba8943370ba4291ea3ccd70af2558058ee6e7a5bd2d6eb577cb19f046b
- MD5 fa2a2cfac4fbe98f0f94ce939a9d3e49
- SHA1 660782b43c5eaf5f731a81eec47ec4d8898a86cb
- SHA512 ed708912242c8f7c7e9c2cffad713c135c586879d9f92c85dce716f24193b431960311dda82fd12af21b1e27613de6a826732129bd602d2200f9f0b4fada1d46
- SSDEEP 786432:6jUZPUSPQWPDiVwDBsVZ15nShfi+6B8O5jnYJIlePAB2PABj:DJUSPQMDiVwDBsVJoi1/5jWjP22P2j
- TLSH T1CE97E129B740D432C6174E39290BC2E8D436FE116D78699B3BB13E0C2BF5B96B539346
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-06_fa2a2cfac4fbe98f0f94ce939a9d3e49_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-06_fa2a2cfac4fbe98f0f94ce939a9d3e49_amadey_darkgate_elex_gcleaner_glassworm_karagany_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
- Size 38.3MB
- SHA256 08a8cfba8943370ba4291ea3ccd70af2558058ee6e7a5bd2d6eb577cb19f046b
- MD5 fa2a2cfac4fbe98f0f94ce939a9d3e49
- SHA1 660782b43c5eaf5f731a81eec47ec4d8898a86cb
- SHA512 ed708912242c8f7c7e9c2cffad713c135c586879d9f92c85dce716f24193b431960311dda82fd12af21b1e27613de6a826732129bd602d2200f9f0b4fada1d46
- SSDEEP 786432:6jUZPUSPQWPDiVwDBsVZ15nShfi+6B8O5jnYJIlePAB2PABj:DJUSPQMDiVwDBsVJoi1/5jWjP22P2j
- TLSH T1CE97E129B740D432C6174E39290BC2E8D436FE116D78699B3BB13E0C2BF5B96B539346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Custom signature
UPX dump on OEP (original entry point)
Checks computer location settings
Looks up country code configured in the registry, likely geofence.