General
- Target 2026-08-07_66455c7b3cd88a17683f54ffe2ab18ee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_remcos_smoke-loader_stealc_tofsee
- Size 74.3MB
- Sample260807-2bk7qaac85
- SHA256 1f979dd7eee4ca7112057e511d804eecc5e9ae6e51876e72ddec881de424d1c3
Score
9/10
Malware Config
Targets
-
- Target 2026-08-07_66455c7b3cd88a17683f54ffe2ab18ee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_remcos_smoke-loader_stealc_tofsee
- Size 74.3MB
- SHA256 1f979dd7eee4ca7112057e511d804eecc5e9ae6e51876e72ddec881de424d1c3
Score9/10-
Detects executables containing possible sandbox analysis VM usernames
-
Detects executables packed with SmartAssembly
-
Drops file in Drivers directory
-
Event Triggered Execution: AppInit DLLs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Stops running service(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
1Service Execution
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1AppInit DLLs
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1AppInit DLLs
1