2b37370eef0b9ac03460355f4015ccf1c277a23001905f1c0cc28dc12536185f | Triage™

Login
Reports

Overview

overview

Static

static

2026-08-27...er.exe

windows10-2004-x64

9

2026-08-27...er.exe

windows11-ltsc_2024-x64

9

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-27_623f03d9576b4751b7e8caa70c35cd10_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader
Size 1.0MB
Sample260827-twelnsbm2s
SHA256 2b37370eef0b9ac03460355f4015ccf1c277a23001905f1c0cc28dc12536185f
MD5 623f03d9576b4751b7e8caa70c35cd10
SHA1 3a9d4302f80466b4f10c8719b57b5f259cd06223
SHA512 a0c17a5a86f733671ad8aef3a43fa96627c390ecda01f7dc0c07621220a6614b82e89fbd5d97bc99921cacae63f7994389605128a6b25f0462251589a0d77666
SSDEEP 24576:CyaP/tK1+RczLlXszt9amUCpIoBjp+/nOm1itVENqNd5A+g9K7xcdY9eRB9c25fn:gS+RcnlX2XU4JX5gK7v9V25fGmVV13Cc
TLSH
T173352911E7A0803AF9E300FA83F605BCAE346B30135625D747C479E9AB65DE57D32A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

2026-08-27_623f03d9576b4751b7e8caa70c35cd10_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

9 signatures

150 seconds

defense_evasion discovery persistence

Behavioral task

behavioral2

Sample

2026-08-27_623f03d9576b4751b7e8caa70c35cd10_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

9 signatures

150 seconds

defense_evasion discovery persistence

Malware Config

Targets

- Target
  2026-08-27_623f03d9576b4751b7e8caa70c35cd10_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader
- Size 1.0MB
- SHA256 2b37370eef0b9ac03460355f4015ccf1c277a23001905f1c0cc28dc12536185f
- MD5 623f03d9576b4751b7e8caa70c35cd10
- SHA1 3a9d4302f80466b4f10c8719b57b5f259cd06223
- SHA512 a0c17a5a86f733671ad8aef3a43fa96627c390ecda01f7dc0c07621220a6614b82e89fbd5d97bc99921cacae63f7994389605128a6b25f0462251589a0d77666
- SSDEEP 24576:CyaP/tK1+RczLlXszt9amUCpIoBjp+/nOm1itVENqNd5A+g9K7xcdY9eRB9c25fn:gS+RcnlX2XU4JX5gK7v9V25fGmVV13Cc
- TLSH
  T173352911E7A0803AF9E300FA83F605BCAE346B30135625D747C479E9AB65DE57D32A27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery persistence
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistence

behavioral2

defense_evasiondiscoverypersistence

© 2018-2026

Terms | Privacy