General
- Target 2026-09-01_71d12e7ea5be456b73c6704ab05ffe91_acrstealer_amadey_darkgate_datper_elex_gcleaner_glassworm_smoke-loader_stop
- Size 6.8MB
- Sample260903-lzw15azzcz
- SHA256 f7dd68588ab9bea1682110dd7cd8ed57535efe6254a9fc94cf16538876c2d1c9
- MD5 71d12e7ea5be456b73c6704ab05ffe91
- SHA1 7a01e7ce9e14fcea8128e885f0a044be62d3b16f
- SHA512 7abcb40d155d033f5aa1e86b03785277667dd05adbf9b7ec96dcc9165c750aae2a184ca33b2f49fe66781fccb795c647a61dae7a827c0dd6c92f26b370388c1e
- SSDEEP 49152:XUAzbm3SV2yGqC2Zq9VIoeGjDkp7Gf+sqX+QpV67JSk2Msjs+DQxCZLoeWgGinHJ:XjwZjDkp7zsqJeJw99ZLo8fg
- TLSH T17F767C03B2858437E0631A3A5877D395583FBA212B2A9DC76FE40E4D0E356C16E3E75B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-09-01_71d12e7ea5be456b73c6704ab05ffe91_acrstealer_amadey_darkgate_datper_elex_gcleaner_glassworm_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-09-01_71d12e7ea5be456b73c6704ab05ffe91_acrstealer_amadey_darkgate_datper_elex_gcleaner_glassworm_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-09-01_71d12e7ea5be456b73c6704ab05ffe91_acrstealer_amadey_darkgate_datper_elex_gcleaner_glassworm_smoke-loader_stop
- Size 6.8MB
- SHA256 f7dd68588ab9bea1682110dd7cd8ed57535efe6254a9fc94cf16538876c2d1c9
- MD5 71d12e7ea5be456b73c6704ab05ffe91
- SHA1 7a01e7ce9e14fcea8128e885f0a044be62d3b16f
- SHA512 7abcb40d155d033f5aa1e86b03785277667dd05adbf9b7ec96dcc9165c750aae2a184ca33b2f49fe66781fccb795c647a61dae7a827c0dd6c92f26b370388c1e
- SSDEEP 49152:XUAzbm3SV2yGqC2Zq9VIoeGjDkp7Gf+sqX+QpV67JSk2Msjs+DQxCZLoeWgGinHJ:XjwZjDkp7zsqJeJw99ZLo8fg
- TLSH T17F767C03B2858437E0631A3A5877D395583FBA212B2A9DC76FE40E4D0E356C16E3E75B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UAC bypass
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1