General
- Target 2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat
- Size 9.2MB
- Sample260701-exp2gaes3l
- SHA256 07d5bdffd14707ae82165e578cae060cc27a413d5a2e619f9fb97f61d81e271c
- MD5 76031e3dc7b409e39740a964c97ec733
- SHA1 eac635b936c432adcf76ad79c54ada3ff8e139f3
- SHA512 eac8a1cfdc21eb18f5c3786e12fcb3fc29e37e6b9d3e17dcef4f79dfbdd4825b82b8470b6c465f8795116154037a7dd7a96921243f17d1131aeeedb5fa13ac95
- SSDEEP 196608:xvsJD+MPo0VTqtQxkNtfv9cycyv+Yug/tUNGi1J:xkxO6xSF7zX/WNGWJ
- TLSH T186A6F113BAC4243AC4BA063A843B97589D3F7A616756CD9F1BF4485C8E361803E3A75F
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260629-en
Malware Config
Targets
-
- Target 2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat
- Size 9.2MB
- SHA256 07d5bdffd14707ae82165e578cae060cc27a413d5a2e619f9fb97f61d81e271c
- MD5 76031e3dc7b409e39740a964c97ec733
- SHA1 eac635b936c432adcf76ad79c54ada3ff8e139f3
- SHA512 eac8a1cfdc21eb18f5c3786e12fcb3fc29e37e6b9d3e17dcef4f79dfbdd4825b82b8470b6c465f8795116154037a7dd7a96921243f17d1131aeeedb5fa13ac95
- SSDEEP 196608:xvsJD+MPo0VTqtQxkNtfv9cycyv+Yug/tUNGi1J:xkxO6xSF7zX/WNGWJ
- TLSH T186A6F113BAC4243AC4BA063A843B97589D3F7A616756CD9F1BF4485C8E361803E3A75F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies WinLogon for persistence
-
Modifies visibility of hidden/system files in Explorer
-
UAC bypass
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
5