General
- Target 2026-08-07_391e84955e0524216436cecfec751363_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat_remcos_smoke-loader_swisyn_vidar
- Size 5.1MB
- Sample260807-gsc78aec58
- SHA256 3fc834694960c2dc22c9a7f2294faa4c49238c4b47e146b5fbcb90e474e25e63
- MD5 391e84955e0524216436cecfec751363
- SHA1 6b0ee31db0477a2de73f94eba781c67e63becb93
- SHA512 313d5a30dd2dfa163dfcc5f943d1fb2e78b34fdc72af706a7f2fbdd8c9d22cf917c4c64304fc8b7a5f5d690cbf3a832b984c9adeeb34efc29cdf25089b4f8777
- SSDEEP 98304:7Op6yZzevblfgaAQo1CPwDv3uF/XmgRkrMvTOpWOpDjOpg:G6qKvJfiL1CPwDv3uF/XyrMvOrag
- TLSH T18146BF0277E40232EABFC334947657769A36BC10933CEBCB56B441B91E677C09A36366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_391e84955e0524216436cecfec751363_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_391e84955e0524216436cecfec751363_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-07_391e84955e0524216436cecfec751363_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat_remcos_smoke-loader_swisyn_vidar
- Size 5.1MB
- SHA256 3fc834694960c2dc22c9a7f2294faa4c49238c4b47e146b5fbcb90e474e25e63
- MD5 391e84955e0524216436cecfec751363
- SHA1 6b0ee31db0477a2de73f94eba781c67e63becb93
- SHA512 313d5a30dd2dfa163dfcc5f943d1fb2e78b34fdc72af706a7f2fbdd8c9d22cf917c4c64304fc8b7a5f5d690cbf3a832b984c9adeeb34efc29cdf25089b4f8777
- SSDEEP 98304:7Op6yZzevblfgaAQo1CPwDv3uF/XmgRkrMvTOpWOpDjOpg:G6qKvJfiL1CPwDv3uF/XyrMvOrag
- TLSH T18146BF0277E40232EABFC334947657769A36BC10933CEBCB56B441B91E677C09A36366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2