General
- Target 2026-08-25_dbec64d7ce81a8f6c8b665946584c549_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys_stealc_vidar
- Size 1.7MB
- Sample260826-g32csshk7z
- SHA256 9fb6bf07f5dcab2fd25ccac12c12eb35161d278f3df882e0b3ca458080de906a
- MD5 dbec64d7ce81a8f6c8b665946584c549
- SHA1 e2a01099cc81f54e963393f532509b7e28721737
- SHA512 d0dfc297e17cea9fb8976c7c0693475f7313048ed167876a180c12203e4b605d4fec63b411ace715a1024ffd3bac7816d9c491721f576043d016a7397b1652d2
- SSDEEP 24576:FuVpERKP2pH7efRtJ3YeEAYOnwj1+M57Ef85PNMLasvqiat:srERKKe1YeEAYOW1+M5A83M+svqiat
- TLSH T18F85171177E95A29F1FB2B31AEB851605A7BBC615F31C7CF13801A5E2970AC09936B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-25_dbec64d7ce81a8f6c8b665946584c549_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_l.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-25_dbec64d7ce81a8f6c8b665946584c549_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_l.exe
Resource
win11ltsc2024-20260710-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-25_dbec64d7ce81a8f6c8b665946584c549_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys_stealc_vidar
- Size 1.7MB
- SHA256 9fb6bf07f5dcab2fd25ccac12c12eb35161d278f3df882e0b3ca458080de906a
- MD5 dbec64d7ce81a8f6c8b665946584c549
- SHA1 e2a01099cc81f54e963393f532509b7e28721737
- SHA512 d0dfc297e17cea9fb8976c7c0693475f7313048ed167876a180c12203e4b605d4fec63b411ace715a1024ffd3bac7816d9c491721f576043d016a7397b1652d2
- SSDEEP 24576:FuVpERKP2pH7efRtJ3YeEAYOnwj1+M57Ef85PNMLasvqiat:srERKKe1YeEAYOW1+M5A83M+svqiat
- TLSH T18F85171177E95A29F1FB2B31AEB851605A7BBC615F31C7CF13801A5E2970AC09936B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1