7fb784e05810004ba75df1c1f5b07d18994aaf564fe15f8e047239f9e9bf96bb

General

Target
2026-08-08_ae91cff2c8faa111c7b86a2f7a7de454_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat.exe
Size 9.9MB
Sample260808-de1vksyepd
SHA256 7fb784e05810004ba75df1c1f5b07d18994aaf564fe15f8e047239f9e9bf96bb
MD5 ae91cff2c8faa111c7b86a2f7a7de454
SHA1 2fe8f4e5778fdbbec6e91507f3de27cde9d493d1
SHA512 4db81554eb54fb5b587c4419687a816197676bde89fc39e5ab3640a4a19f0016a728edfa085d7b7ecf814654e7c42c40de825691655fc075e9ef7c50e7759d21
SSDEEP 98304:IbY/fPSK3RjzVd55j+q6biL4J76YaIWr1Xn7A3beyOCjPdZ04A2+LjdXD7:IiSKtz3wA4d6Y0l7oe6lm4A2c
TLSH
T1FAA65B02FEC291FEC98F02B0A00D93395A7F991453158DE7CE87ADB85BA63D11D3662D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Figma Agent = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-08_ae91cff2c8faa111c7b86a2f7a7de454_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat.exe\""	2026-08-08_ae91cff2c8faa111c7b86a2f7a7de454_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_ae91cff2c8faa111c7b86a2f7a7de454_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_ae91cff2c8faa111c7b86a2f7a7de454_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5c0000000100000004000000000800000b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2026-08-08_ae91cff2c8faa111c7b86a2f7a7de454_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	2026-08-08_ae91cff2c8faa111c7b86a2f7a7de454_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_ae91cff2c8faa111c7b86a2f7a7de454_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_ae91cff2c8faa111c7b86a2f7a7de454_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:1424

C:\Users\Admin\AppData\Local\Temp\2026-08-08_ae91cff2c8faa111c7b86a2f7a7de454_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_ae91cff2c8faa111c7b86a2f7a7de454_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5044