General
- Target 2026-07-03_64bb899d7b228f29280fec7e87a42164_amadey_darkgate_elex_gazer_glassworm_helldown_luca-stealer_lynx_njrat_remcos
- Size 13.6MB
- Sample260703-dg573sax2s
- SHA256 c65c9bc5a3afbd6e3df4bf8e8801af386c6cc31ccea60148794bb108e7e01ad4
- MD5 64bb899d7b228f29280fec7e87a42164
- SHA1 dff582c5552c4f45287920e70c08eb2f1ae8130b
- SHA512 8d358b25129eb240a3e89c90a78444865d722c383eb4c4cf91fdc952dbce1c4309805abbe42db456ce1444b4c26d27666287af9a21ed133219af936bd5dc41dc
- SSDEEP 393216:Sicu6bE0lQcK8gDyMtKKFdu9CwJsv6tjNi+s:F0lUHtgNip
- TLSH T1CCE6BF13B69280B9D96212B0512FB327D37DD9310B35D187B3D87E8E6EF11E26A27253
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-03_64bb899d7b228f29280fec7e87a42164_amadey_darkgate_elex_gazer_glassworm_helldown_luca-stealer_lynx_njrat_remcos.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_64bb899d7b228f29280fec7e87a42164_amadey_darkgate_elex_gazer_glassworm_helldown_luca-stealer_lynx_njrat_remcos.exe
Resource
win11ltsc2024-20260629-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-03_64bb899d7b228f29280fec7e87a42164_amadey_darkgate_elex_gazer_glassworm_helldown_luca-stealer_lynx_njrat_remcos
- Size 13.6MB
- SHA256 c65c9bc5a3afbd6e3df4bf8e8801af386c6cc31ccea60148794bb108e7e01ad4
- MD5 64bb899d7b228f29280fec7e87a42164
- SHA1 dff582c5552c4f45287920e70c08eb2f1ae8130b
- SHA512 8d358b25129eb240a3e89c90a78444865d722c383eb4c4cf91fdc952dbce1c4309805abbe42db456ce1444b4c26d27666287af9a21ed133219af936bd5dc41dc
- SSDEEP 393216:Sicu6bE0lQcK8gDyMtKKFdu9CwJsv6tjNi+s:F0lUHtgNip
- TLSH T1CCE6BF13B69280B9D96212B0512FB327D37DD9310B35D187B3D87E8E6EF11E26A27253
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.