General
- Target 2026-05-03_dac9a90dba078b5d203773c0f74b12b4_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys
- Size 1.7MB
- Sample260503-rcscbabs3v
- SHA256 68bfc09a0f65198b4ef6f26570a062236bebd93428b11131325482b294cdc06c
- MD5 dac9a90dba078b5d203773c0f74b12b4
- SHA1 52f9773ceb3f90caeb2b984be9547257d1e0b9de
- SHA512 c1a2ed011aa940a752dbbb906e32f54c58ced70395aa3cc7619bc79e7091d1cf00add5327bf10931c1ce4d1375b3ff81e79e81a7bf37ca253ad20d5d5a832d22
- SSDEEP 49152:GDkpzY8JuOkHGMXNoFO8Hk3Ezb6pPtfqig:GDkpzY8JwoFO8HKEdig
- TLSH T1BE85081177E95A29F1FB2731AEB855604A7BBC615F31C7CF13802E5E2934AC09936B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-03_dac9a90dba078b5d203773c0f74b12b4_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-ste.exe
Resource
win10v2004-20260130-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-03_dac9a90dba078b5d203773c0f74b12b4_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-ste.exe
Resource
win11-20260130-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-03_dac9a90dba078b5d203773c0f74b12b4_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys
- Size 1.7MB
- SHA256 68bfc09a0f65198b4ef6f26570a062236bebd93428b11131325482b294cdc06c
- MD5 dac9a90dba078b5d203773c0f74b12b4
- SHA1 52f9773ceb3f90caeb2b984be9547257d1e0b9de
- SHA512 c1a2ed011aa940a752dbbb906e32f54c58ced70395aa3cc7619bc79e7091d1cf00add5327bf10931c1ce4d1375b3ff81e79e81a7bf37ca253ad20d5d5a832d22
- SSDEEP 49152:GDkpzY8JuOkHGMXNoFO8Hk3Ezb6pPtfqig:GDkpzY8JwoFO8HKEdig
- TLSH T1BE85081177E95A29F1FB2731AEB855604A7BBC615F31C7CF13802E5E2934AC09936B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory