General
- Target 2026-08-19_892d0fe9e21db2bcb706609bca13bab1_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos
- Size 1.6MB
- Sample260819-qch8zafc32
- SHA256 d7541a0f03c41b8ac670be362235a474caf604c831fabf1ef4f64117805bad4e
- MD5 892d0fe9e21db2bcb706609bca13bab1
- SHA1 2d7056b2bfca3f67c077c5bc4ebb4566421a1f4f
- SHA512 c336072fe9129b875db9ed4ecad334d52c82934e388f62caef3c00ff712cab0b7c5993222f9481c533bffe333a859f41fc2061e1b7f046a004a2a0d3a23b1a84
- SSDEEP 24576:SR2DdnfEgsaUInwtj0sVwRvXkSHCytY4eWLiaomWDkySo+7MjpiRqHmLqfGowKuN:S3gsHmowRvFLWDkySOiR9Lqfh3uN
- TLSH T1C185AF2037DA8536F6B211726E7C966B503DBD620F3281CF62D84A5E6970DC21E37B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_892d0fe9e21db2bcb706609bca13bab1_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_892d0fe9e21db2bcb706609bca13bab1_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos
- Size 1.6MB
- SHA256 d7541a0f03c41b8ac670be362235a474caf604c831fabf1ef4f64117805bad4e
- MD5 892d0fe9e21db2bcb706609bca13bab1
- SHA1 2d7056b2bfca3f67c077c5bc4ebb4566421a1f4f
- SHA512 c336072fe9129b875db9ed4ecad334d52c82934e388f62caef3c00ff712cab0b7c5993222f9481c533bffe333a859f41fc2061e1b7f046a004a2a0d3a23b1a84
- SSDEEP 24576:SR2DdnfEgsaUInwtj0sVwRvXkSHCytY4eWLiaomWDkySo+7MjpiRqHmLqfGowKuN:S3gsHmowRvFLWDkySOiR9Lqfh3uN
- TLSH T1C185AF2037DA8536F6B211726E7C966B503DBD620F3281CF62D84A5E6970DC21E37B27
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1