0662891f74be372a2153693f877f43e5f32fc21db8b836c344370815ab23ab30

General

Target
2026-07-14_92eff0ff90395b7994a16f442ac0825c_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat
Size 2.4MB
Sample260714-d2aa5sdt8r
SHA256 0662891f74be372a2153693f877f43e5f32fc21db8b836c344370815ab23ab30
MD5 92eff0ff90395b7994a16f442ac0825c
SHA1 ec1d6ae737260693e9f46fdc8f3eb30568c88718
SHA512 34ced815afdeb390ee9590a00f5d793b92092dac9f60b58ab4170e2daa19c91ce67eb16322163d2763214055d0cdc3e7a5be448d207267a3db4fc2b6cd5289e5
SSDEEP 49152:IfC7+hLkJiLw/KtbDITXjJG0zvq8ulcdhhtosT1MNYMnMznc2:loLr9DITjJG0boO1RH
TLSH
T1F8C59E22FB8290B2E4D601B062BE6BF75D797234532558CBE3C01D6A59202D3763AF5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-14_92eff0ff90395b7994a16f442ac0825c_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat
- Size 2.4MB
- SHA256 0662891f74be372a2153693f877f43e5f32fc21db8b836c344370815ab23ab30
- MD5 92eff0ff90395b7994a16f442ac0825c
- SHA1 ec1d6ae737260693e9f46fdc8f3eb30568c88718
- SHA512 34ced815afdeb390ee9590a00f5d793b92092dac9f60b58ab4170e2daa19c91ce67eb16322163d2763214055d0cdc3e7a5be448d207267a3db4fc2b6cd5289e5
- SSDEEP 49152:IfC7+hLkJiLw/KtbDITXjJG0zvq8ulcdhhtosT1MNYMnMznc2:loLr9DITjJG0boO1RH
- TLSH
  T1F8C59E22FB8290B2E4D601B062BE6BF75D797234532558CBE3C01D6A59202D3763AF5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access discovery spyware stealer defense_evasion
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables containing possible sandbox analysis VM names
- Detects executables containing possible sandbox analysis VM usernames
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2