General
- Target 2026-07-31_a9ab6d75b72f0ec6e4c904d492018c36_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos
- Size 1.6MB
- Sample260731-ey5tbatfkf
- SHA256 5d32883bb94023867e38777f8008e34b8027abaedfbd82ea528b0a11ab072f06
- MD5 a9ab6d75b72f0ec6e4c904d492018c36
- SHA1 82d00339e9950e63c2ba5f3dc883b0630d0bc8f0
- SHA512 7339faed3e1346eeda1f2c939cd391cd64d33148e42a927efc51454ee70537c8c65029eaf0479338cdeea8fb158c05ca814d52b67885b5b3777a84a729f22794
- SSDEEP 24576:aR2DdnfEgsaUInwtj0sVwRvXkSHCytY4eWLiaomWDRrqUQSAlkSB+pfAOQ+7jXj+:a3gsHmowRvFLWDxq9SASScpfB5X
- TLSH T19C85B06037C69136F6B211726E7C956B503DBA620F3281CF62D88A5E6970DC21E37B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_a9ab6d75b72f0ec6e4c904d492018c36_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-31_a9ab6d75b72f0ec6e4c904d492018c36_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos
- Size 1.6MB
- SHA256 5d32883bb94023867e38777f8008e34b8027abaedfbd82ea528b0a11ab072f06
- MD5 a9ab6d75b72f0ec6e4c904d492018c36
- SHA1 82d00339e9950e63c2ba5f3dc883b0630d0bc8f0
- SHA512 7339faed3e1346eeda1f2c939cd391cd64d33148e42a927efc51454ee70537c8c65029eaf0479338cdeea8fb158c05ca814d52b67885b5b3777a84a729f22794
- SSDEEP 24576:aR2DdnfEgsaUInwtj0sVwRvXkSHCytY4eWLiaomWDRrqUQSAlkSB+pfAOQ+7jXj+:a3gsHmowRvFLWDxq9SASScpfB5X
- TLSH T19C85B06037C69136F6B211726E7C956B503DBA620F3281CF62D88A5E6970DC21E37B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1