General
- Target 2026-07-20_bbb485765a52f2182a9ead63483a242f_amadey_blackenergy_darkgate_elex_emotet_glassworm_luca-stealer_njrat_remcos_smoke-loader_stop
- Size 14.2MB
- Sample260720-vlez5agz5q
- SHA256 794a7280fc3f0e9e1334ea05458104ec7feabc6929fea4ac75c65b2eee533cc6
- MD5 bbb485765a52f2182a9ead63483a242f
- SHA1 7443a24e6ecc088a3973d382cd3f68eb219c3697
- SHA512 6902fe73295b4d27d300dff876031dbab61f38e7763e33c0a2223379229b044b58412d8ff0d7556258a1cd6096a4882afe9abfd3f2715977e5a4435118a858f4
- SSDEEP 196608:EGBfWt4rk66HtIto0AqeGZF6bUpMBF1p/kjRm4OWi2bzoYqS:FWg6YoSIbUwF1VERmj2b8BS
- TLSH T142E6CF64B2B3753CC32B987440ADDE73BD3038551B608D7B51C5DBB42E17A68A92BB32
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-20_bbb485765a52f2182a9ead63483a242f_amadey_blackenergy_darkgate_elex_emotet_glassworm_luca-s.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_bbb485765a52f2182a9ead63483a242f_amadey_blackenergy_darkgate_elex_emotet_glassworm_luca-stealer_njrat_remcos_smoke-loader_stop
- Size 14.2MB
- SHA256 794a7280fc3f0e9e1334ea05458104ec7feabc6929fea4ac75c65b2eee533cc6
- MD5 bbb485765a52f2182a9ead63483a242f
- SHA1 7443a24e6ecc088a3973d382cd3f68eb219c3697
- SHA512 6902fe73295b4d27d300dff876031dbab61f38e7763e33c0a2223379229b044b58412d8ff0d7556258a1cd6096a4882afe9abfd3f2715977e5a4435118a858f4
- SSDEEP 196608:EGBfWt4rk66HtIto0AqeGZF6bUpMBF1p/kjRm4OWi2bzoYqS:FWg6YoSIbUwF1VERmj2b8BS
- TLSH T142E6CF64B2B3753CC32B987440ADDE73BD3038551B608D7B51C5DBB42E17A68A92BB32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1