General
- Target 2026-09-30_c455e585bba42c8b87ceaf9bbdf4d29e_amadey_darkgate_elex_glassworm_hammertoss_icedid_luca-stealer_njrat
- Size 21.1MB
- Sample261001-hatypazy2k
- SHA256 a3f6931ee7d0ee3b1367970d6b1718064a2d78eacc82ffd3bdf86f237a691f40
- MD5 c455e585bba42c8b87ceaf9bbdf4d29e
- SHA1 b1204e318010f6764b97ea2208895715f9d86057
- SHA512 38d975ca545a3fdecded39cc9b9158037b2f37b6a123d02a0b84d56ffca5b5f01c88c205c843490e44f287ba2f0a7ae4dac9ce74e114bed90555f2134ac8bd53
- SSDEEP 393216:zAIwXTqMCZhxR21z0wGQUJ+ci6WCmuuHkZUa+AASnUKF2cOnpF+ra5:sHWP01z0TJJKOmuuHkZcAj7tkpl
- TLSH T128272212F7A64436C46F423897ABAA9563367003A720DBCF7B8C92290F177E1CD36B55
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-09-30_c455e585bba42c8b87ceaf9bbdf4d29e_amadey_darkgate_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_c455e585bba42c8b87ceaf9bbdf4d29e_amadey_darkgate_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-30_c455e585bba42c8b87ceaf9bbdf4d29e_amadey_darkgate_elex_glassworm_hammertoss_icedid_luca-stealer_njrat
- Size 21.1MB
- SHA256 a3f6931ee7d0ee3b1367970d6b1718064a2d78eacc82ffd3bdf86f237a691f40
- MD5 c455e585bba42c8b87ceaf9bbdf4d29e
- SHA1 b1204e318010f6764b97ea2208895715f9d86057
- SHA512 38d975ca545a3fdecded39cc9b9158037b2f37b6a123d02a0b84d56ffca5b5f01c88c205c843490e44f287ba2f0a7ae4dac9ce74e114bed90555f2134ac8bd53
- SSDEEP 393216:zAIwXTqMCZhxR21z0wGQUJ+ci6WCmuuHkZUa+AASnUKF2cOnpF+ra5:sHWP01z0TJJKOmuuHkZcAj7tkpl
- TLSH T128272212F7A64436C46F423897ABAA9563367003A720DBCF7B8C92290F177E1CD36B55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.