General
- Target 2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil_smoke-loader
- Size 4.6MB
- Sample261002-t3fsbaec66
- SHA256 c58ce45e95d5cda7ddc0c5b823ea78491a4e6738e7e4e5bf58d230a257455530
- MD5 39afd6febb7eeb70b5728fd5d86506b4
- SHA1 618b8b214bc64f8d5d92954867c767c95e1697a6
- SHA512 b6a662de1debcaf682bdee7bb08c83a95a9d7857abcae209aceca5ce0df679da9498111f80325e7dd04d5f3c893bace255947281d9b34bf23a2f3d0e3b274404
- SSDEEP 98304:EC0Uq/np6a7nwvXlUvUF4hGFoLAPdc5MUAE:lq/nAo443GSLW6MUA
- TLSH T18636D012FBC281B1E5930174556ABB3F8D3DBA34672489C7ABC01D2D8C316D16A3A79F
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Resource
win10v2004-20260911-en
18 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil_smoke-loader
- Size 4.6MB
- SHA256 c58ce45e95d5cda7ddc0c5b823ea78491a4e6738e7e4e5bf58d230a257455530
- MD5 39afd6febb7eeb70b5728fd5d86506b4
- SHA1 618b8b214bc64f8d5d92954867c767c95e1697a6
- SHA512 b6a662de1debcaf682bdee7bb08c83a95a9d7857abcae209aceca5ce0df679da9498111f80325e7dd04d5f3c893bace255947281d9b34bf23a2f3d0e3b274404
- SSDEEP 98304:EC0Uq/np6a7nwvXlUvUF4hGFoLAPdc5MUAE:lq/nAo443GSLW6MUA
- TLSH T18636D012FBC281B1E5930174556ABB3F8D3DBA34672489C7ABC01D2D8C316D16A3A79F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1