General
- Target 2026-07-11_3d982a24246101fe7e382313bf582f23_amadey_cloudeye_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys
- Size 2.2MB
- Sample260711-xd722sbs9v
- SHA256 80bfd85b17f19cacd1722c4c7b63c376d98c55f5eb97d0ad6e3e542503e5b6d9
- MD5 3d982a24246101fe7e382313bf582f23
- SHA1 1e494d7b6cd245b9d2dd2c2348e9c278e727361e
- SHA512 a22df566925e60145df2b288464198105244dc3c721f738fde5171f6a6a4b4ebe177d7093125f1fc155408303c2db3f688484928a62275a54453f0371019e05d
- SSDEEP 49152:c/7t0ioT48KKe1YeEAYOW1+M5A83M+svqia/:Ge4ZKsW1+M5N3
- TLSH T1E4B53A1177E95A25F1BB1731ADB892605A77BCA16F31C7CF13802A5E2D31BC09A36723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_3d982a24246101fe7e382313bf582f23_amadey_cloudeye_darkgate_elex_hijackloader_icedid_luca-s.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-11_3d982a24246101fe7e382313bf582f23_amadey_cloudeye_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys
- Size 2.2MB
- SHA256 80bfd85b17f19cacd1722c4c7b63c376d98c55f5eb97d0ad6e3e542503e5b6d9
- MD5 3d982a24246101fe7e382313bf582f23
- SHA1 1e494d7b6cd245b9d2dd2c2348e9c278e727361e
- SHA512 a22df566925e60145df2b288464198105244dc3c721f738fde5171f6a6a4b4ebe177d7093125f1fc155408303c2db3f688484928a62275a54453f0371019e05d
- SSDEEP 49152:c/7t0ioT48KKe1YeEAYOW1+M5A83M+svqia/:Ge4ZKsW1+M5N3
- TLSH T1E4B53A1177E95A25F1BB1731ADB892605A77BCA16F31C7CF13802A5E2D31BC09A36723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1