General
- Target 2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil
- Size 20.3MB
- Sample261011-hdazzsdc23
- SHA256 7de779ee1e7b10e0a2d1d29abb1eb6cbe0b4d8183e90bc46ac9fb7eca248f18c
- MD5 a3c7e98205330fc2f969ce9d5b155c5e
- SHA1 5aaf60fb5216ee83599d3f8f0ef8432ea944cca0
- SHA512 de8af51746bf0f81feec32abbd1ef04c90cd173ffffe6add4f13f210902ec63c142583c3623a92ff00c9e06f87780705cd8db900aa5c8ffc5a3db6f608bd2100
- SSDEEP 393216:0nzDLkPDezzAiia7wowy0WCQIVLJsv6tWKFdu9CxIcj:mkLev6a/50WqIA
- TLSH T14327E142B6C340B5EA611170992BE36A8735BD158BB6C6D7B3883BDD9F31290793B343
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
Resource
win10v2004-20260911-en
21 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil
- Size 20.3MB
- SHA256 7de779ee1e7b10e0a2d1d29abb1eb6cbe0b4d8183e90bc46ac9fb7eca248f18c
- MD5 a3c7e98205330fc2f969ce9d5b155c5e
- SHA1 5aaf60fb5216ee83599d3f8f0ef8432ea944cca0
- SHA512 de8af51746bf0f81feec32abbd1ef04c90cd173ffffe6add4f13f210902ec63c142583c3623a92ff00c9e06f87780705cd8db900aa5c8ffc5a3db6f608bd2100
- SSDEEP 393216:0nzDLkPDezzAiia7wowy0WCQIVLJsv6tWKFdu9CxIcj:mkLev6a/50WqIA
- TLSH T14327E142B6C340B5EA611170992BE36A8735BD158BB6C6D7B3883BDD9F31290793B343
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Defense Evasion
Direct Volume Access
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1