General
- Target 2026-10-16_70084e85e1498b3e78c870c5f114e1f6_darkgate_elex_gcleaner_glassworm_icedid_njrat_swisyn_vidar
- Size 16.0MB
- Sample261017-r94fvafe39
- SHA256 1b78149b4d4ccbcc0ada7529cc7232dbb549722debe68dbeae9c0d3279b3b624
- MD5 70084e85e1498b3e78c870c5f114e1f6
- SHA1 8c8e3258cc7659b3ad1bcb71d42643ac02d0d8de
- SHA512 d6cd02b204e5748d1ecd68d867b0476b8727ad04337f786e5e5b88c370c4e2ad2042bcf3e13bd3875beec78fd049648e7629cc5252374051d4e8aad35f24af37
- SSDEEP 196608:pDkrOd4cp2q3B1Ye04iuB9BaFZhxXHfGvAkt1RPb+Qp3HBJBWuF9gJf1PGcvF6wE:pDR/y79hGjXMM
- TLSH T1F2074C6572B1C1F5C02584789A9A765BFA353C014F604ADF92A1A56E9FF3AE04CFE330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-10-16_70084e85e1498b3e78c870c5f114e1f6_darkgate_elex_gcleaner_glassworm_icedid_njrat_swisyn_vidar.exe
Resource
win10v2004-20260911-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-16_70084e85e1498b3e78c870c5f114e1f6_darkgate_elex_gcleaner_glassworm_icedid_njrat_swisyn_vidar.exe
Resource
win11ltsc2024-20260911-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-16_70084e85e1498b3e78c870c5f114e1f6_darkgate_elex_gcleaner_glassworm_icedid_njrat_swisyn_vidar
- Size 16.0MB
- SHA256 1b78149b4d4ccbcc0ada7529cc7232dbb549722debe68dbeae9c0d3279b3b624
- MD5 70084e85e1498b3e78c870c5f114e1f6
- SHA1 8c8e3258cc7659b3ad1bcb71d42643ac02d0d8de
- SHA512 d6cd02b204e5748d1ecd68d867b0476b8727ad04337f786e5e5b88c370c4e2ad2042bcf3e13bd3875beec78fd049648e7629cc5252374051d4e8aad35f24af37
- SSDEEP 196608:pDkrOd4cp2q3B1Ye04iuB9BaFZhxXHfGvAkt1RPb+Qp3HBJBWuF9gJf1PGcvF6wE:pDR/y79hGjXMM
- TLSH T1F2074C6572B1C1F5C02584789A9A765BFA353C014F604ADF92A1A56E9FF3AE04CFE330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2