General
- Target 2026-06-30_aa1b5cd5d4cc175e452a151ebf49e7e2_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos
- Size 1.6MB
- Sample260701-dygaaaft4z
- SHA256 892cd6c97c506eb82bc5fa0d6c1d529f8cdeb21cc23c8ba7b6a8f6f7cefa652c
- MD5 aa1b5cd5d4cc175e452a151ebf49e7e2
- SHA1 d475d4390f68bd46f482d3ab4321adc1ced8b4e6
- SHA512 6efa64792341f5bc9ad6a7d113f20cdc7a1a5b0bd2dfaccdd669e455bcf8357a635f1365f2fb08b1b7e08777994df50c88b2baf9531a0c0d30db4f6ed80b326b
- SSDEEP 24576:GcdnaquligZ+PSJjsqjnhMgeiCl7G0nehbGZpbD:GYSZFnDmg27RnWGj
- TLSH T15175E052B7C0C0B1E9721930CA65A7F999BDBD20F924CD0B67D93E5D79B01C0963A3A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-30_aa1b5cd5d4cc175e452a151ebf49e7e2_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_aa1b5cd5d4cc175e452a151ebf49e7e2_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
Resource
win11ltsc2024-20260629-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-30_aa1b5cd5d4cc175e452a151ebf49e7e2_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos
- Size 1.6MB
- SHA256 892cd6c97c506eb82bc5fa0d6c1d529f8cdeb21cc23c8ba7b6a8f6f7cefa652c
- MD5 aa1b5cd5d4cc175e452a151ebf49e7e2
- SHA1 d475d4390f68bd46f482d3ab4321adc1ced8b4e6
- SHA512 6efa64792341f5bc9ad6a7d113f20cdc7a1a5b0bd2dfaccdd669e455bcf8357a635f1365f2fb08b1b7e08777994df50c88b2baf9531a0c0d30db4f6ed80b326b
- SSDEEP 24576:GcdnaquligZ+PSJjsqjnhMgeiCl7G0nehbGZpbD:GYSZFnDmg27RnWGj
- TLSH T15175E052B7C0C0B1E9721930CA65A7F999BDBD20F924CD0B67D93E5D79B01C0963A3A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory