General
- Target 2026-07-09_2e66fee53d77f6c04f55aa12486393a6_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil
- Size 4.5MB
- Sample260709-krhyvsfv8n
- SHA256 008c266d13348c0681e2d3f99ed832124a8ae7b7c1851805959bd781d4d82325
- MD5 2e66fee53d77f6c04f55aa12486393a6
- SHA1 90275bb59db7c6326d35b1131a01b8b9eec8042d
- SHA512 ca312f3515cc545305ef5777834275350f3a4bcfd3840c1512e6fd6f32262bcf2918975dd6dc63b73eedf8549d5c8b9c690dcbdf06e16587792af696b761f760
- SSDEEP 98304:m7aAA8ratb8ly+32x855a37I/xm80ozLUBx+:m7aAXk/+hK7Ipm8Ox+
- TLSH T1D426BF12FA81C4B1D2530375595AB77A45BFAA301B34C1C7A7D80A6E5E704D2BA3B3E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-09_2e66fee53d77f6c04f55aa12486393a6_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_2e66fee53d77f6c04f55aa12486393a6_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Resource
win11ltsc2024-20260706-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_2e66fee53d77f6c04f55aa12486393a6_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil
- Size 4.5MB
- SHA256 008c266d13348c0681e2d3f99ed832124a8ae7b7c1851805959bd781d4d82325
- MD5 2e66fee53d77f6c04f55aa12486393a6
- SHA1 90275bb59db7c6326d35b1131a01b8b9eec8042d
- SHA512 ca312f3515cc545305ef5777834275350f3a4bcfd3840c1512e6fd6f32262bcf2918975dd6dc63b73eedf8549d5c8b9c690dcbdf06e16587792af696b761f760
- SSDEEP 98304:m7aAA8ratb8ly+32x855a37I/xm80ozLUBx+:m7aAXk/+hK7Ipm8Ox+
- TLSH T1D426BF12FA81C4B1D2530375595AB77A45BFAA301B34C1C7A7D80A6E5E704D2BA3B3E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.