General
- Target 2026-08-11_0e120235c27e20750896cea17b2ac525_acrstealer_amadey_darkgate_datper_elex_gcleaner_glassworm_smoke-loader_stop
- Size 6.9MB
- Sample260811-efxd8a1tay
- SHA256 54575e9cf0b8ff1bb95fc6b8d0889522edfd45fa267877fd5f2a3073ccea804c
- MD5 0e120235c27e20750896cea17b2ac525
- SHA1 a681f8c9d2592a007267032c17e5914c0db59314
- SHA512 b965de8ba0b920d393b02f860db9b1ace384fbc5b9ac266dcfcb8c1a94f8663e44f1a1ae473cf1f4dbe692dbc29a8ab063077fec75b62ad1d86d8513dd41ba9b
- SSDEEP 49152:8UAzbm3SV2yGqC2Zq9V3oeGjDkp7Gf+sqX+QpV67JSk2Msjs+DQxCZLoeWgGinHJ:8jXZjDkp7zsqJeJw99ZLo8fg
- TLSH T12E767C03B3858437D0631A3A5867D3A5593FBA212B2A9DC72FE40E4D0E356C16E3E75B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-11_0e120235c27e20750896cea17b2ac525_acrstealer_amadey_darkgate_datper_elex_gcleaner_glassworm_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-08-11_0e120235c27e20750896cea17b2ac525_acrstealer_amadey_darkgate_datper_elex_gcleaner_glassworm_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-08-11_0e120235c27e20750896cea17b2ac525_acrstealer_amadey_darkgate_datper_elex_gcleaner_glassworm_smoke-loader_stop
- Size 6.9MB
- SHA256 54575e9cf0b8ff1bb95fc6b8d0889522edfd45fa267877fd5f2a3073ccea804c
- MD5 0e120235c27e20750896cea17b2ac525
- SHA1 a681f8c9d2592a007267032c17e5914c0db59314
- SHA512 b965de8ba0b920d393b02f860db9b1ace384fbc5b9ac266dcfcb8c1a94f8663e44f1a1ae473cf1f4dbe692dbc29a8ab063077fec75b62ad1d86d8513dd41ba9b
- SSDEEP 49152:8UAzbm3SV2yGqC2Zq9V3oeGjDkp7Gf+sqX+QpV67JSk2Msjs+DQxCZLoeWgGinHJ:8jXZjDkp7zsqJeJw99ZLo8fg
- TLSH T12E767C03B3858437D0631A3A5867D3A5593FBA212B2A9DC72FE40E4D0E356C16E3E75B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UAC bypass
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1