25c0d6ff06cfaf77641154902a23acd97e5f8f9b7bf9bebbe4ec4d29c7d4092a

General

Target
2026-08-09_b624d0e60a0b78eb72656d853db46a2d_amadey_darkgate_hijackloader_icedid_luca-stealer_njrat_remcos_stealc
Size 8.9MB
Sample260809-1ldpyscf36
SHA256 25c0d6ff06cfaf77641154902a23acd97e5f8f9b7bf9bebbe4ec4d29c7d4092a
MD5 b624d0e60a0b78eb72656d853db46a2d
SHA1 ea4247f0f03d63b7309251dce32549f8f7191ff8
SHA512 20f8eea2abf2f1a6c58d32cba62fc170751ea51b5538996234d4dfe5da30d4334106ad6235013be72605f4405dd9d6e2b43a98e0af0a9a5cd9d1dd3f8ea7003d
SSDEEP 196608:gWFsTuRN2zahf1Y7EcnGf7a+JJIlAmnVTvQf2b0U:LFsTuRN2zsmEzRJJPm2eb0U
TLSH
T1BA96CF227E5AC52AD5610DB0593CAB6A911C7D290B60A4C7B3CC7D1FEBF00C61636F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-08-09_b624d0e60a0b78eb72656d853db46a2d_amadey_darkgate_hijackloader_icedid_luca-stealer_njrat_remcos_stealc
- Size 8.9MB
- SHA256 25c0d6ff06cfaf77641154902a23acd97e5f8f9b7bf9bebbe4ec4d29c7d4092a
- MD5 b624d0e60a0b78eb72656d853db46a2d
- SHA1 ea4247f0f03d63b7309251dce32549f8f7191ff8
- SHA512 20f8eea2abf2f1a6c58d32cba62fc170751ea51b5538996234d4dfe5da30d4334106ad6235013be72605f4405dd9d6e2b43a98e0af0a9a5cd9d1dd3f8ea7003d
- SSDEEP 196608:gWFsTuRN2zahf1Y7EcnGf7a+JJIlAmnVTvQf2b0U:LFsTuRN2zsmEzRJJPm2eb0U
- TLSH
  T1BA96CF227E5AC52AD5610DB0593CAB6A911C7D290B60A4C7B3CC7D1FEBF00C61636F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence upx
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2