General
- Target 2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos
- Size 2.2MB
- Sample261003-whreesvt6r
- SHA256 26291847e6f073c0ed614ce68a8d3f58284306e0a6c2d5b8994bf4a453fa47fc
- MD5 07988da917f78aa494d68f1d87c71b78
- SHA1 8017f5b9177c7082903eb0f06d38f4414c6852e8
- SHA512 75662cb31bf5c2f04630f71e8b0457df626e9d34cb2a7e6ab68baf1d58d179459d4fba12e115d141a62bd9ce4e26b446b622f1f39ea50684aa7291ad110da1b3
- SSDEEP 49152:kSy74I4qtZp9wlhcb9BO+Z/dGLMuLZHQ1EsO:s4Gp9w8O+Jb1W
- TLSH T18AB55BA3A52B8131D673483054776E168F6F3D290BB108E36189BE1F057AAD36B3F617
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos
- Size 2.2MB
- SHA256 26291847e6f073c0ed614ce68a8d3f58284306e0a6c2d5b8994bf4a453fa47fc
- MD5 07988da917f78aa494d68f1d87c71b78
- SHA1 8017f5b9177c7082903eb0f06d38f4414c6852e8
- SHA512 75662cb31bf5c2f04630f71e8b0457df626e9d34cb2a7e6ab68baf1d58d179459d4fba12e115d141a62bd9ce4e26b446b622f1f39ea50684aa7291ad110da1b3
- SSDEEP 49152:kSy74I4qtZp9wlhcb9BO+Z/dGLMuLZHQ1EsO:s4Gp9w8O+Jb1W
- TLSH T18AB55BA3A52B8131D673483054776E168F6F3D290BB108E36189BE1F057AAD36B3F617
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1