General
- Target 2026-07-23_2307e708ee5dbcea8386d00c3e749f88_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader
- Size 3.5MB
- Sample260724-anyvssdh36
- SHA256 2c973085e37ef96b122e6da37d68f23e7403e2d6356019123ed51e34e2333650
- MD5 2307e708ee5dbcea8386d00c3e749f88
- SHA1 ee1dbe537158b32af978677da9ee0f94df93c1fb
- SHA512 076569e48a6769ddcce7111d2d945851ace798058b28a7ab6599936ce2b51ad06f84a1c7a939df8f1db71f0ca5787fe0431f6cf6111e9fe1416d40d94f24b4c8
- SSDEEP 49152:rC1dghmi4O8A1+FMI+mLXnyWwk7yts4kX05mJlex0wMX7P7u/TS2hreZ0VCaQVgR:rC1dghmicAIayL3yWsShamlTYHYaB
- TLSH T162069E3379408278D3A22130DD6DAF615FBDF52B07F65ADB37C409EA1A709C27936A06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_2307e708ee5dbcea8386d00c3e749f88_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
Resource
win10v2004-20260513-en
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_2307e708ee5dbcea8386d00c3e749f88_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
18 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_2307e708ee5dbcea8386d00c3e749f88_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader
- Size 3.5MB
- SHA256 2c973085e37ef96b122e6da37d68f23e7403e2d6356019123ed51e34e2333650
- MD5 2307e708ee5dbcea8386d00c3e749f88
- SHA1 ee1dbe537158b32af978677da9ee0f94df93c1fb
- SHA512 076569e48a6769ddcce7111d2d945851ace798058b28a7ab6599936ce2b51ad06f84a1c7a939df8f1db71f0ca5787fe0431f6cf6111e9fe1416d40d94f24b4c8
- SSDEEP 49152:rC1dghmi4O8A1+FMI+mLXnyWwk7yts4kX05mJlex0wMX7P7u/TS2hreZ0VCaQVgR:rC1dghmicAIayL3yWsShamlTYHYaB
- TLSH T162069E3379408278D3A22130DD6DAF615FBDF52B07F65ADB37C409EA1A709C27936A06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3