General
- Target 2026-07-08_53bb29d67b2bf1d30721ab1a264cfeb7_amadey_coinminer_darkgate_elex_emotet_glassworm_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 27.9MB
- Sample260708-wh97jadz5m
- SHA256 bdbb857302e3faf613e5a6291ebe9345b327f1ecdef48dfd481c4e182bfe89b3
- MD5 53bb29d67b2bf1d30721ab1a264cfeb7
- SHA1 eb5d52d5fcc65898abfc68cd392c7023eadbed20
- SHA512 37b4b89e8b7baf4830d68b1d1707ecb88bc7ae79ced0a2c5f6fbe62df53e67c1dc9b7c9b3ebe9b551dd2ab7d07b22357afde248f0ae075176a073e85c2b6a4a9
- SSDEEP 196608:2/3f4ZfXqEZln8sbbXxoqSepSF38LBqxLceuOriT1wbLFoA+iKs2egn8sNnrx:24Zvqy8s5oqLpSV4OiJi/ssTy8sz
- TLSH T11B57CF23F2A2C17EC055D13990AA5BB3F63634A60739C6F777C01AA85F716C09A3B356
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-08_53bb29d67b2bf1d30721ab1a264cfeb7_amadey_coinminer_darkgate_elex_emotet_glassworm_icedid_l.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-08_53bb29d67b2bf1d30721ab1a264cfeb7_amadey_coinminer_darkgate_elex_emotet_glassworm_icedid_l.exe
Resource
win11ltsc2024-20260706-en
Malware Config
Targets
-
- Target 2026-07-08_53bb29d67b2bf1d30721ab1a264cfeb7_amadey_coinminer_darkgate_elex_emotet_glassworm_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 27.9MB
- SHA256 bdbb857302e3faf613e5a6291ebe9345b327f1ecdef48dfd481c4e182bfe89b3
- MD5 53bb29d67b2bf1d30721ab1a264cfeb7
- SHA1 eb5d52d5fcc65898abfc68cd392c7023eadbed20
- SHA512 37b4b89e8b7baf4830d68b1d1707ecb88bc7ae79ced0a2c5f6fbe62df53e67c1dc9b7c9b3ebe9b551dd2ab7d07b22357afde248f0ae075176a073e85c2b6a4a9
- SSDEEP 196608:2/3f4ZfXqEZln8sbbXxoqSepSF38LBqxLceuOriT1wbLFoA+iKs2egn8sNnrx:24Zvqy8s5oqLpSV4OiJi/ssTy8sz
- TLSH T11B57CF23F2A2C17EC055D13990AA5BB3F63634A60739C6F777C01AA85F716C09A3B356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1