General
- Target 2026-07-23_c10cd923d7eaeeeb05dc03f0890ac48f_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader
- Size 1.5MB
- Sample260723-3b9qrade83
- SHA256 1b9efc6384fb91a4b3073ecd2e1599d0fad19639071126ae8a198a723f3dba30
- MD5 c10cd923d7eaeeeb05dc03f0890ac48f
- SHA1 7a46aaa2cf08117192c27682b566221f58f545b6
- SHA512 180df57fcb090762b0a4acc749524f9e6efd30608ea8603c0e87a719ac1e32198c8a6cda64a745db81c366a42f067b4ac28d2c07032bb383c0f4525bf79a02c7
- SSDEEP 24576:fp624dpobCWUCf32ur+fpkAlzqmeqYw/GL6UUgEblSZi/heF7qdVWOeOJ8rOfKdP:c21UyHGG2UJAfJl8rPdTg6FD/
- TLSH T18B759E62F78280A3E98201F061AA97F65E387631571558E3E3C05EA569712C2773FF2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-23_c10cd923d7eaeeeb05dc03f0890ac48f_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_c10cd923d7eaeeeb05dc03f0890ac48f_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_c10cd923d7eaeeeb05dc03f0890ac48f_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader
- Size 1.5MB
- SHA256 1b9efc6384fb91a4b3073ecd2e1599d0fad19639071126ae8a198a723f3dba30
- MD5 c10cd923d7eaeeeb05dc03f0890ac48f
- SHA1 7a46aaa2cf08117192c27682b566221f58f545b6
- SHA512 180df57fcb090762b0a4acc749524f9e6efd30608ea8603c0e87a719ac1e32198c8a6cda64a745db81c366a42f067b4ac28d2c07032bb383c0f4525bf79a02c7
- SSDEEP 24576:fp624dpobCWUCf32ur+fpkAlzqmeqYw/GL6UUgEblSZi/heF7qdVWOeOJ8rOfKdP:c21UyHGG2UJAfJl8rPdTg6FD/
- TLSH T18B759E62F78280A3E98201F061AA97F65E387631571558E3E3C05EA569712C2773FF2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Executes dropped EXE
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1