General
- Target 2026-07-04_db95795e52854f4bd7c2adb3d9ee0484_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat_remcos_smoke-loader_swisyn_vidar
- Size 5.1MB
- Sample260704-3pt78ae12s
- SHA256 e91d0e0990d2d566a732b3bc4742960483cf48210119a356d28fef4853f2b28c
- MD5 db95795e52854f4bd7c2adb3d9ee0484
- SHA1 0538790a9adeee2be90731ba451e6f52ad4ebded
- SHA512 d358408e5ce68a2c26d8db2165dbd8dc9aa17c0c3f048b3e2c5ab5d12554947bdc9889e098403f4b53b238e3a5f6a530ca3f47cb975abeea3637278b66816f91
- SSDEEP 98304:UOp6yZzevblfgaAQo1CPwDv3uF/XmgRkrMvTOpWOpDjOpY:56qKvJfiL1CPwDv3uF/XyrMvOraY
- TLSH T16546BF0277E40232E9BFC33494765776AA36BC10933CEBCB56B441B91E677C09A36366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-04_db95795e52854f4bd7c2adb3d9ee0484_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-04_db95795e52854f4bd7c2adb3d9ee0484_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260629-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-04_db95795e52854f4bd7c2adb3d9ee0484_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat_remcos_smoke-loader_swisyn_vidar
- Size 5.1MB
- SHA256 e91d0e0990d2d566a732b3bc4742960483cf48210119a356d28fef4853f2b28c
- MD5 db95795e52854f4bd7c2adb3d9ee0484
- SHA1 0538790a9adeee2be90731ba451e6f52ad4ebded
- SHA512 d358408e5ce68a2c26d8db2165dbd8dc9aa17c0c3f048b3e2c5ab5d12554947bdc9889e098403f4b53b238e3a5f6a530ca3f47cb975abeea3637278b66816f91
- SSDEEP 98304:UOp6yZzevblfgaAQo1CPwDv3uF/XmgRkrMvTOpWOpDjOpY:56qKvJfiL1CPwDv3uF/XyrMvOraY
- TLSH T16546BF0277E40232E9BFC33494765776AA36BC10933CEBCB56B441B91E677C09A36366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2