bceb2d0668eadc2d584b0766b6e4ac61c4cb9a2da2c0b651b7bbbd4e1d0c9c21

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 11:22

Target
2026-05-22_0dd6bf7423c90578db03f89201196d63_amadey_darkgate_elex_luca-stealer_manuscrypt_njrat_rhada.exe
Size 4.7MB
Sample260522-ngrd2ab17v
SHA256 bceb2d0668eadc2d584b0766b6e4ac61c4cb9a2da2c0b651b7bbbd4e1d0c9c21
MD5 0dd6bf7423c90578db03f89201196d63
SHA1 b2e34f619dab52f60eddea029102d2fd8b311791
SHA512 29ea09abe22a15611a245bfdbe566feecc82cac6ac5670b8aeb5b5cce1eb4436c5e9b021e9163e676675929075733db5a52b8792469f93c5ebda0716aa4c6d7b
SSDEEP 98304:4RsCNsDOWRN8f01iuciNu2zPnj/7pxXoyI75r8:4a/6+NwnYBzzXoxr8
TLSH
T1DD362A037F9C5631E1BF3E304C76E3C885657E524A22A95B2DC47E4DEA719C1B92CB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/672-0-0x0000000000400000-0x00000000004ED000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4496	672	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-22_0dd6bf7423c90578db03f89201196d63_amadey_darkgate_elex_luca-stealer_manuscrypt_njrat_rhada.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_0dd6bf7423c90578db03f89201196d63_amadey_darkgate_elex_luca-stealer_manuscrypt_njrat_rhada.exe"
1⤵
PID:672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 8
  2⤵
  - Program crash
  PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 672 -ip 672
1⤵
PID:4940

memory/672-0-0x0000000000400000-0x00000000004ED000-memory.dmp

Download