General
- Target 2026-07-22_581cb43b2e972b480e3857ff192bd20c_amadey_darkgate_datper_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat_remcos_smoke-loader
- Size 3.3MB
- Sample260722-wdbheaej8t
- SHA256 e10ba1c12315e339adbc6a8441fa07a8583c3b4e690f58f9ae6c8c863d1d6305
- MD5 581cb43b2e972b480e3857ff192bd20c
- SHA1 816420c8062864b0ca3aa9b6945281d31c586da8
- SHA512 c5e3085a4658a83212e97131e9bda8ea062d7c33f7f8b2e22a38cf9384f0cea59d8f26965d7455fe1d690261b0e1f18ff037a44ae01218a76a8c30cfedc92f5f
- SSDEEP 49152:ZUuBTOjZwS1Ihk+hy7iHuaRZnt+NTNLiG97mQj:ZXRO0hkr2Rxt+eHQ
- TLSH T151F55B17B284183FC06B173A4837A754993FBE216A269C1F17F478CC8E7A5817D3A64B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-22_581cb43b2e972b480e3857ff192bd20c_amadey_darkgate_datper_elex_gcleaner_glassworm_hellokitt.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-22_581cb43b2e972b480e3857ff192bd20c_amadey_darkgate_datper_elex_gcleaner_glassworm_hellokitt.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-07-22_581cb43b2e972b480e3857ff192bd20c_amadey_darkgate_datper_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat_remcos_smoke-loader
- Size 3.3MB
- SHA256 e10ba1c12315e339adbc6a8441fa07a8583c3b4e690f58f9ae6c8c863d1d6305
- MD5 581cb43b2e972b480e3857ff192bd20c
- SHA1 816420c8062864b0ca3aa9b6945281d31c586da8
- SHA512 c5e3085a4658a83212e97131e9bda8ea062d7c33f7f8b2e22a38cf9384f0cea59d8f26965d7455fe1d690261b0e1f18ff037a44ae01218a76a8c30cfedc92f5f
- SSDEEP 49152:ZUuBTOjZwS1Ihk+hy7iHuaRZnt+NTNLiG97mQj:ZXRO0hkr2Rxt+eHQ
- TLSH T151F55B17B284183FC06B173A4837A754993FBE216A269C1F17F478CC8E7A5817D3A64B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies WinLogon for persistence
-
Modifies visibility of hidden/system files in Explorer
-
UAC bypass
-
Executes dropped EXE
-
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1