General
- Target 2026-07-18_bb680f3e081f623b839250c4ad2dab96_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader
- Size 5.5MB
- Sample260718-s5429aey2q
- SHA256 d7bebacc78483e5b80c6001bfbcea0704a4f7cd251ead6e3f087e4763a2acf9c
- MD5 bb680f3e081f623b839250c4ad2dab96
- SHA1 aca3e18aca7bba2ae3efa911b968dc66f23d4ec1
- SHA512 bb8fe4135d10bfc9c6688c84e56bbb38f8a4277cd06393890aea01e5dc1b36072e5d049a4c2db8d0799c1dfaee157ae305a46ce323ba6750f87330675d61f3d7
- SSDEEP 98304:Q8vj23XO7INTOKdWOm39VQOuKigT3SsPyFRUhE1Azc9uP:njgO7InF+6gTkFRjew9i
- TLSH T10046CF22F940C075E5D100B2D6BE6FB6897D89300B3598D77BC41DA94A306E3773AB6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-18_bb680f3e081f623b839250c4ad2dab96_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_bb680f3e081f623b839250c4ad2dab96_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Resource
win11ltsc2024-20260709-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-18_bb680f3e081f623b839250c4ad2dab96_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader
- Size 5.5MB
- SHA256 d7bebacc78483e5b80c6001bfbcea0704a4f7cd251ead6e3f087e4763a2acf9c
- MD5 bb680f3e081f623b839250c4ad2dab96
- SHA1 aca3e18aca7bba2ae3efa911b968dc66f23d4ec1
- SHA512 bb8fe4135d10bfc9c6688c84e56bbb38f8a4277cd06393890aea01e5dc1b36072e5d049a4c2db8d0799c1dfaee157ae305a46ce323ba6750f87330675d61f3d7
- SSDEEP 98304:Q8vj23XO7INTOKdWOm39VQOuKigT3SsPyFRUhE1Azc9uP:njgO7InF+6gTkFRjew9i
- TLSH T10046CF22F940C075E5D100B2D6BE6FB6897D89300B3598D77BC41DA94A306E3773AB6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger