General
- Target 2026-07-09_667eb34dd666be768745b7266ff96530_amadey_bandook_coinminer_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader_zebrocy
- Size 23.4MB
- Sample260709-ke19nsfs2q
- SHA256 3bba565dbf0a6d341e16a8f1b7262935cee3b5fc08aba1df23b451377f1a5760
- MD5 667eb34dd666be768745b7266ff96530
- SHA1 29a669bd912ba4cff5046fe4640230e895247b62
- SHA512 4bea9d30e44e939fa93b866a113ddedd2057bc28ce37b9db1f5b297e14141d99bbb85dd3bec828a2f1402bccfac1583b1ace6db588ca5eba7a80c201bbe86c2e
- SSDEEP 393216:ki/uCD2/wCiYiVsw6/yvb3Cu32WpIqZzh9tf6U1OG7j1rVvoosq4Y:vVPvb3CumatiiOGdrbJ
- TLSH T142375B25A900C233E2E64134CC9E4592A6286E2CE7B46FD721A57EDCEB313C67535B4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-09_667eb34dd666be768745b7266ff96530_amadey_bandook_coinminer_darkgate_elex_gcleaner_glasswor.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_667eb34dd666be768745b7266ff96530_amadey_bandook_coinminer_darkgate_elex_gcleaner_glasswor.exe
Resource
win11ltsc2024-20260706-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_667eb34dd666be768745b7266ff96530_amadey_bandook_coinminer_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader_zebrocy
- Size 23.4MB
- SHA256 3bba565dbf0a6d341e16a8f1b7262935cee3b5fc08aba1df23b451377f1a5760
- MD5 667eb34dd666be768745b7266ff96530
- SHA1 29a669bd912ba4cff5046fe4640230e895247b62
- SHA512 4bea9d30e44e939fa93b866a113ddedd2057bc28ce37b9db1f5b297e14141d99bbb85dd3bec828a2f1402bccfac1583b1ace6db588ca5eba7a80c201bbe86c2e
- SSDEEP 393216:ki/uCD2/wCiYiVsw6/yvb3Cu32WpIqZzh9tf6U1OG7j1rVvoosq4Y:vVPvb3CumatiiOGdrbJ
- TLSH T142375B25A900C233E2E64134CC9E4592A6286E2CE7B46FD721A57EDCEB313C67535B4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.