General
- Target 2026-07-23_6e8e911660ed003d733c3317155b4da7_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys
- Size 1.7MB
- Sample260723-1eqe6sdc48
- SHA256 0698fd7db011d305a5c9698d8dea149a56643aee36bb606f449353fd6b9b5eb1
- MD5 6e8e911660ed003d733c3317155b4da7
- SHA1 9d01f080c12fd65bef89438f0dfb1c8c32a4fb2a
- SHA512 c813eae62b6a9d78d5f3852beadd07065b26de8b805ef48949abaab53be4ee33506c151bbe6f6fdb5592fcf5876ef19f6be500d3fd43643c56d2f2af890510ae
- SSDEEP 49152:GDkpzY8JuOkHGMXNoFO8Hk3Ezb6pPtfqid:GDkpzY8JwoFO8HKEdid
- TLSH T1A385081177E95A29F1FB2731AEB855604A7BBC615F31C7CF13802E5E2934AC09936B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_6e8e911660ed003d733c3317155b4da7_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-ste.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_6e8e911660ed003d733c3317155b4da7_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-ste.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_6e8e911660ed003d733c3317155b4da7_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys
- Size 1.7MB
- SHA256 0698fd7db011d305a5c9698d8dea149a56643aee36bb606f449353fd6b9b5eb1
- MD5 6e8e911660ed003d733c3317155b4da7
- SHA1 9d01f080c12fd65bef89438f0dfb1c8c32a4fb2a
- SHA512 c813eae62b6a9d78d5f3852beadd07065b26de8b805ef48949abaab53be4ee33506c151bbe6f6fdb5592fcf5876ef19f6be500d3fd43643c56d2f2af890510ae
- SSDEEP 49152:GDkpzY8JuOkHGMXNoFO8Hk3Ezb6pPtfqid:GDkpzY8JwoFO8HKEdid
- TLSH T1A385081177E95A29F1FB2731AEB855604A7BBC615F31C7CF13802E5E2934AC09936B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory