General
- Target 2026-07-08_bbc01b3f7cfea8e7d5cbdd85ac71f975_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_poet-rat_remcos_revil
- Size 23.2MB
- Sample260708-vh5rdacz4m
- SHA256 d13054ca4cbf270b058a514f9d4a2b1131d19a753ebeb53d3aa81abc89d333b4
- MD5 bbc01b3f7cfea8e7d5cbdd85ac71f975
- SHA1 02454a5cbd141e30de97f6bf9db647cff185af6b
- SHA512 8301bff32e887497deb0fd226a848bee19b176bac2759e6b482412c2becafed6e2e76e3a83fcae2506d301f3ab97eb5219cbea66ec67921bb3ee1c48e2144df3
- SSDEEP 393216:CAPubOCJqCvkpUcSwmliAbIn0JHogVVM4/74gWWmapez7BwO2uaCOy:ZPfCJqCM4wmlz80JIohWapezd4y
- TLSH T1C737BE227781847AF0B211F05A6DABAA477DB9301B7481CB72D86B7D0D716C3D932B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-08_bbc01b3f7cfea8e7d5cbdd85ac71f975_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_bbc01b3f7cfea8e7d5cbdd85ac71f975_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Resource
win11ltsc2024-20260706-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-08_bbc01b3f7cfea8e7d5cbdd85ac71f975_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_poet-rat_remcos_revil
- Size 23.2MB
- SHA256 d13054ca4cbf270b058a514f9d4a2b1131d19a753ebeb53d3aa81abc89d333b4
- MD5 bbc01b3f7cfea8e7d5cbdd85ac71f975
- SHA1 02454a5cbd141e30de97f6bf9db647cff185af6b
- SHA512 8301bff32e887497deb0fd226a848bee19b176bac2759e6b482412c2becafed6e2e76e3a83fcae2506d301f3ab97eb5219cbea66ec67921bb3ee1c48e2144df3
- SSDEEP 393216:CAPubOCJqCvkpUcSwmliAbIn0JHogVVM4/74gWWmapez7BwO2uaCOy:ZPfCJqCM4wmlz80JIohWapezd4y
- TLSH T1C737BE227781847AF0B211F05A6DABAA477DB9301B7481CB72D86B7D0D716C3D932B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Contacts a large (30491) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Checks whether UAC is enabled