General
- Target 2026-09-12_d5b1d44550cc871312b56e9811b0e62c_amadey_darkgate_elex_luca-stealer_njrat_olyx_remcos_smoke-loader_stealc_stop
- Size 14.2MB
- Sample260912-vcbakstsas
- SHA256 c3988612122816ed61c6bfacbd9a5151d96c8921ddac50d2de7dd1abc1a0ac38
- MD5 d5b1d44550cc871312b56e9811b0e62c
- SHA1 8f63fd3508b49b0bb144327e09785f39c9188d00
- SHA512 00e678af415eb1960dd0e144a40e25515acee002ed62f2f8bb96800b6c6afc6e940f368ba396c61dbb351386f93212e757eb114ff49c67070e1f0ad0e4cf0606
- SSDEEP 393216:7u5mkIbUWIbUwF1VERmTYJ4eXfGWe31lwC:7uNIYWIY0788d
- TLSH T143E6BE05E743C1B6E81308B1690AF7FE0A103A345631CC97F6D47F49A7B2DE6A626727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-12_d5b1d44550cc871312b56e9811b0e62c_amadey_darkgate_elex_luca-stealer_njrat_olyx_remcos_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-12_d5b1d44550cc871312b56e9811b0e62c_amadey_darkgate_elex_luca-stealer_njrat_olyx_remcos_smoke-loader_stealc_stop.exe
Resource
win11ltsc2024-20260911-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-12_d5b1d44550cc871312b56e9811b0e62c_amadey_darkgate_elex_luca-stealer_njrat_olyx_remcos_smoke-loader_stealc_stop
- Size 14.2MB
- SHA256 c3988612122816ed61c6bfacbd9a5151d96c8921ddac50d2de7dd1abc1a0ac38
- MD5 d5b1d44550cc871312b56e9811b0e62c
- SHA1 8f63fd3508b49b0bb144327e09785f39c9188d00
- SHA512 00e678af415eb1960dd0e144a40e25515acee002ed62f2f8bb96800b6c6afc6e940f368ba396c61dbb351386f93212e757eb114ff49c67070e1f0ad0e4cf0606
- SSDEEP 393216:7u5mkIbUWIbUwF1VERmTYJ4eXfGWe31lwC:7uNIYWIY0788d
- TLSH T143E6BE05E743C1B6E81308B1690AF7FE0A103A345631CC97F6D47F49A7B2DE6A626727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Adds Run key to start application
-
Drops file in System32 directory