General
- Target 2026-07-20_1094ecb67bd342be0bb00193b1bce12b_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos
- Size 5.5MB
- Sample260720-d3rltagx7v
- SHA256 2d21ee065594eb3282a5c88ecf5a98c355e214f8cb10e3d1c6271043789bd5ae
- MD5 1094ecb67bd342be0bb00193b1bce12b
- SHA1 f78bc2b315df6c70c0ef4e86409ab0d2e4e63afa
- SHA512 c0c421b4ed9a86e84a1f5e9f1214dc2bf94f69f512b19e623097caa85308878869f212a16cddc7d9950ab1722d8528461f0165d15fa168a7151e37036c8d7aa0
- SSDEEP 49152:ToEKYHrJg1NNNRNNNTONL/TO98VChBtzysUVap/UmKYHrJg1NNNRNNNTONb/TO95:cwkbtzysiGAbtzysi
- TLSH T1D946BE00EFA16836FC2286754DEA23664438FD31F74205DF9393F61E57619F22A3729A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_1094ecb67bd342be0bb00193b1bce12b_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_1094ecb67bd342be0bb00193b1bce12b_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos
- Size 5.5MB
- SHA256 2d21ee065594eb3282a5c88ecf5a98c355e214f8cb10e3d1c6271043789bd5ae
- MD5 1094ecb67bd342be0bb00193b1bce12b
- SHA1 f78bc2b315df6c70c0ef4e86409ab0d2e4e63afa
- SHA512 c0c421b4ed9a86e84a1f5e9f1214dc2bf94f69f512b19e623097caa85308878869f212a16cddc7d9950ab1722d8528461f0165d15fa168a7151e37036c8d7aa0
- SSDEEP 49152:ToEKYHrJg1NNNRNNNTONL/TO98VChBtzysUVap/UmKYHrJg1NNNRNNNTONb/TO95:cwkbtzysiGAbtzysi
- TLSH T1D946BE00EFA16836FC2286754DEA23664438FD31F74205DF9393F61E57619F22A3729A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL