General
- Target 2026-07-01_32990fd7442f2daa29a5b79a0ad5abda_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_smoke-loader_swisyn
- Size 2.3MB
- Sample260701-cajvtscs7n
- SHA256 b1e4a52b79874eefcc4f8d004939fa0ae891362e0b358f80c8be7c72989f4dca
- MD5 32990fd7442f2daa29a5b79a0ad5abda
- SHA1 e80b913cef26bfed32093e7df91bcfb063a0678a
- SHA512 b110816387bf50c147d23d56e6bfbb5c73ae1bc6fe95d6dc4848d46495f78f3c00159efa6819bedea2f6e8a3dd8950446c5126a6e09d1ccef13445083e8a914c
- SSDEEP 49152:tp2e1iify35cdrrFJAWb/8amDe8hSSw0K:z2e1FKpUrrFJAWbCH8So
- TLSH T132B5C02279408232E65240B065BEAB7AA97DBD344B3045C7E3C03E7A59227D27F3675F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_32990fd7442f2daa29a5b79a0ad5abda_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_32990fd7442f2daa29a5b79a0ad5abda_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Resource
win11ltsc2024-20260629-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-01_32990fd7442f2daa29a5b79a0ad5abda_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_smoke-loader_swisyn
- Size 2.3MB
- SHA256 b1e4a52b79874eefcc4f8d004939fa0ae891362e0b358f80c8be7c72989f4dca
- MD5 32990fd7442f2daa29a5b79a0ad5abda
- SHA1 e80b913cef26bfed32093e7df91bcfb063a0678a
- SHA512 b110816387bf50c147d23d56e6bfbb5c73ae1bc6fe95d6dc4848d46495f78f3c00159efa6819bedea2f6e8a3dd8950446c5126a6e09d1ccef13445083e8a914c
- SSDEEP 49152:tp2e1iify35cdrrFJAWb/8amDe8hSSw0K:z2e1FKpUrrFJAWbCH8So
- TLSH T132B5C02279408232E65240B065BEAB7AA97DBD344B3045C7E3C03E7A59227D27F3675F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2