General
- Target 2026-05-11_bf89a9aa6c236663d62222fbd148b5f2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil
- Size 3.5MB
- Sample260511-npbcsagw3x
- SHA256 9517a161c8e2d297a1f8b7beac49393436971937f9150546ab4a2866b079646c
- MD5 bf89a9aa6c236663d62222fbd148b5f2
- SHA1 e6d8f56c2decb7939f05b6c4c98627ba7fcde46a
- SHA512 6a09e9b9262db4c7c1ffb2a76f50355c3459868d8aff00f9f3180b1da084d72cf5f255ac22a176db2af67096e00e465a1c20d275ba3a1da48280cd2b6b08f48a
- SSDEEP 98304:LrNAjlaNjVtHkejatuHVU2zL2twnWfMkYPHsh:A9t92zywrvy
- TLSH T10606DF02BB808071F5F34671957A173E4D3DBE201324A8CBD3D4695A4DB26E17B3AB9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_bf89a9aa6c236663d62222fbd148b5f2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_bf89a9aa6c236663d62222fbd148b5f2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
Resource
win11-20260130-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-11_bf89a9aa6c236663d62222fbd148b5f2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil
- Size 3.5MB
- SHA256 9517a161c8e2d297a1f8b7beac49393436971937f9150546ab4a2866b079646c
- MD5 bf89a9aa6c236663d62222fbd148b5f2
- SHA1 e6d8f56c2decb7939f05b6c4c98627ba7fcde46a
- SHA512 6a09e9b9262db4c7c1ffb2a76f50355c3459868d8aff00f9f3180b1da084d72cf5f255ac22a176db2af67096e00e465a1c20d275ba3a1da48280cd2b6b08f48a
- SSDEEP 98304:LrNAjlaNjVtHkejatuHVU2zL2twnWfMkYPHsh:A9t92zywrvy
- TLSH T10606DF02BB808071F5F34671957A173E4D3DBE201324A8CBD3D4695A4DB26E17B3AB9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.