General
- Target 2026-07-08_6c35ae7cca178c1adc902e6f8b3de5f5_elex_luca-stealer_medusalocker_njrat_remcos
- Size 1.7MB
- Sample260708-sd7ztsgz3v
- SHA256 18ffdb987b159def9a28aa7dc1f98695852375c2e150976fd0028e65f7c76c30
- MD5 6c35ae7cca178c1adc902e6f8b3de5f5
- SHA1 56db6ef40b49a6703686bbf50feac0ba9b89de01
- SHA512 715b885505e1f87dc07f6e37f18b0dc94d6b0d3e2a495b69e4e8f245e6c9fcb91fed5b0a4376652942ab156601266a032b6e89f69bc510085e4678f0d7844cc7
- SSDEEP 49152:azoBcbEjevtsejamFIIO128xxSFhaT7wiy63JeI2lC8s:K/+QC2UwE7Bnx2lC8
- TLSH T11585F1213AE9C439F6B317306EBED6AA042DBEB44F3584EB77C0551D28705D25A72B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_6c35ae7cca178c1adc902e6f8b3de5f5_elex_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_6c35ae7cca178c1adc902e6f8b3de5f5_elex_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win11ltsc2024-20260706-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-08_6c35ae7cca178c1adc902e6f8b3de5f5_elex_luca-stealer_medusalocker_njrat_remcos
- Size 1.7MB
- SHA256 18ffdb987b159def9a28aa7dc1f98695852375c2e150976fd0028e65f7c76c30
- MD5 6c35ae7cca178c1adc902e6f8b3de5f5
- SHA1 56db6ef40b49a6703686bbf50feac0ba9b89de01
- SHA512 715b885505e1f87dc07f6e37f18b0dc94d6b0d3e2a495b69e4e8f245e6c9fcb91fed5b0a4376652942ab156601266a032b6e89f69bc510085e4678f0d7844cc7
- SSDEEP 49152:azoBcbEjevtsejamFIIO128xxSFhaT7wiy63JeI2lC8s:K/+QC2UwE7Bnx2lC8
- TLSH T11585F1213AE9C439F6B317306EBED6AA042DBEB44F3584EB77C0551D28705D25A72B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1