2f0ebeb5228f5ee245c8c69a40acd653e170b5499f6aded2e8a03534e1389568 | Triage™

Login
Reports

Overview

overview

7

Static

static

3

2026-08-02...at.exe

windows10-2004-x64

7

2026-08-02...at.exe

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat
Size 2.2MB
Sample260802-schcsabf94
SHA256 2f0ebeb5228f5ee245c8c69a40acd653e170b5499f6aded2e8a03534e1389568
MD5 0149262876387cf96988c6714e32bf11
SHA1 c8f9f329da2dad2c04adceeba29a0a443f32bad2
SHA512 0501434f1301ffde1d9b435282627e3a083bd10d0dc02351e8a4e2b7cc947c0390dbcf288d888fd0d845bb95f4e3a111087768db2ec7a460278957b28302035a
SSDEEP 49152:P2stiiXqvQ9HXXx++kpBASZAvYAWXzc5Zd3K2z7+EVo:eGX4Q9HHx++kpBkv7a2/+E
TLSH
T1A2B5BF12B246C073E59316B1726D6BFA5AAC7D3417B154DBB2C03E3E58301D3793AE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence ransomware spyware stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

19 signatures

150 seconds

discovery persistence ransomware spyware stealer

Behavioral task

behavioral2

Sample

2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

19 signatures

150 seconds

discovery persistence spyware stealer

Malware Config

Targets

- Target
  2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat
- Size 2.2MB
- SHA256 2f0ebeb5228f5ee245c8c69a40acd653e170b5499f6aded2e8a03534e1389568
- MD5 0149262876387cf96988c6714e32bf11
- SHA1 c8f9f329da2dad2c04adceeba29a0a443f32bad2
- SHA512 0501434f1301ffde1d9b435282627e3a083bd10d0dc02351e8a4e2b7cc947c0390dbcf288d888fd0d845bb95f4e3a111087768db2ec7a460278957b28302035a
- SSDEEP 49152:P2stiiXqvQ9HXXx++kpBASZAvYAWXzc5Zd3K2z7+EVo:eGX4Q9HHx++kpBkv7a2/+E
- TLSH
  T1A2B5BF12B246C073E59316B1726D6BFA5AAC7D3417B154DBB2C03E3E58301D3793AE2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence ransomware spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceransomwarespywarestealer

behavioral2

discoverypersistencespywarestealer

© 2018-2026

Terms | Privacy