General
- Target 2026-08-01_4c4bd2b39ff6d5ed3815fef78e33ab30_akira_amadey_darkgate_elex_hijackloader_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop
- Size 11.2MB
- Sample260801-vg366atvh1
- SHA256 3d795a1d8c9bf5fb20a04b1c0b7a329ac0e2d9894436cc90f0abd2bc75cd8a63
- MD5 4c4bd2b39ff6d5ed3815fef78e33ab30
- SHA1 a905ac776f3e3917ece24db96805264734aad8b1
- SHA512 d1d9260ec698aedd6d05c7729f0526be705e455b9d3e5d8ed85ed8af97ce160fa42ca20a781f7d3bc49ba230a8eee8f5c4791cf276d6fe19c58a3b2e6f3a677f
- SSDEEP 196608:3GTJJodeGZF6bUpMBF1p/kjRm4OWiTVajP/Q7URb:2cRIbUwF1VERmjTVaD/Q7UZ
- TLSH T1EFC67B2236D1CFE5C41F51B0DC19B6F94627AC20DF210FCB6A44BE693AB16D25931A2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_4c4bd2b39ff6d5ed3815fef78e33ab30_akira_amadey_darkgate_elex_hijackloader_luca-stealer_man.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_4c4bd2b39ff6d5ed3815fef78e33ab30_akira_amadey_darkgate_elex_hijackloader_luca-stealer_man.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_4c4bd2b39ff6d5ed3815fef78e33ab30_akira_amadey_darkgate_elex_hijackloader_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop
- Size 11.2MB
- SHA256 3d795a1d8c9bf5fb20a04b1c0b7a329ac0e2d9894436cc90f0abd2bc75cd8a63
- MD5 4c4bd2b39ff6d5ed3815fef78e33ab30
- SHA1 a905ac776f3e3917ece24db96805264734aad8b1
- SHA512 d1d9260ec698aedd6d05c7729f0526be705e455b9d3e5d8ed85ed8af97ce160fa42ca20a781f7d3bc49ba230a8eee8f5c4791cf276d6fe19c58a3b2e6f3a677f
- SSDEEP 196608:3GTJJodeGZF6bUpMBF1p/kjRm4OWiTVajP/Q7URb:2cRIbUwF1VERmjTVaD/Q7UZ
- TLSH T1EFC67B2236D1CFE5C41F51B0DC19B6F94627AC20DF210FCB6A44BE693AB16D25931A2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory