Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/08/2026, 10:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-22_2e29baf2410f8e580542a1c6648c9069_amadey_darkgate_elex_glassworm_icedid_krakenkeylogger_lu.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_2e29baf2410f8e580542a1c6648c9069_amadey_darkgate_elex_glassworm_icedid_krakenkeylogger_lu.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-08-22_2e29baf2410f8e580542a1c6648c9069_amadey_darkgate_elex_glassworm_icedid_krakenkeylogger_lu.exe
- Size 23.7MB
- Sample260823-mnbfqaaa49
- SHA256 84b8523f7fb4783fd0baae6b080adb1b5aac388192145ad713e504c69954556d
- MD5 2e29baf2410f8e580542a1c6648c9069
- SHA1 ee0de114a554513d4c84d54e25e32ae27c6a4ba5
- SHA512 6ec2148e15c58d3f803eab57173c0cc12651503269f6b794904c2fa5030465946c1eb700a318a8cbc0d446a08acdabbc51ee9775836760aa906938265446ca8a
- SSDEEP 196608:G3/RIx2hxp4GPWJYJYOA1Ksc/EfyLN4xhKJ5pdMa5luw9a+a:i2AhP4jJYJbiKsc/EaLzpBLRa
- TLSH T1F5477B11A3EC8A26D5FF1335A835561997B6B8566321D3CF318CA5AE1F23BD08932373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects encrypted or obfuscated .NET executables 1 IoCs
resource yara_rule behavioral1/memory/4152-0-0x0000021BD2D50000-0x0000021BD4504000-memory.dmp INDICATOR_EXE_DotNET_Encrypted - Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/memory/4152-0-0x0000021BD2D50000-0x0000021BD4504000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\2026-08-22_2e29baf2410f8e580542a1c6648c9069_amadey_darkgate_elex_glassworm_icedid_krakenkeylogger_lu\VER.2026-05-13.23.03.24.516\tutorial.cs.txt
- Size 1KB
- SHA256 188b364b193afc40f0ed0060de685c7a454ca1a39d9ab8464ab6fce6bebf1e66
- MD5 d508785092a0761299f39c34dc569591
- SHA1 286832470cafe7d8c0d5d4f5454129d5577ee789
- SHA512 a2dcf23d94167677b7a0f4c4f8ab2c21ca1c0ff2d1f1b17c4bb6abd5239b150791f4db09c8f986f3ecf0ccbb0a5452f6648dabc8949a277a326d9e1194e41165
- TLSH T1F131DD5D1C81432A0D3A92568F9361A8F319D6372268AC18FC9F8B5A7F30C81017CEAD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\2026-08-22_2e29baf2410f8e580542a1c6648c9069_amadey_darkgate_elex_glassworm_icedid_krakenkeylogger_lu\VER.2026-05-13.23.03.24.516\x86\Microsoft.Diagnostics.Runtime.dll
- Size 629KB
- SHA256 11946975d7506ca1bee498faea1b8df76fcc3dc8aac733b19177ff0eb633ce56
- MD5 471cac661fc84d06d3fc153cb92e98fa
- SHA1 1003fce5b0156cf46f1d7d28cc9e2b6972293f91
- SHA512 8b0f0c29ad61aea517dda8b0a03ae016e1157a87440da88094a0e353da1ba4c3d26a5e6d91d17ae775c251570507cba3eb9fba04b616bb6b422a6531819bca08
- SSDEEP 12288:9FbhzWR1rHo5ysRlMOeQEkEHvb2rPFezAhb:JzAJHoXRPHEkEHCrdis
- TLSH T143D45C1577AC57B7DACE1B3BA471A86857B2F107B112F71E5148EAAB1C83783CD402A3
- MD5 SHA1 SHA512 SSDEEP TLSH