General
- Target 2026-07-09_ceace82d61134d0153f2af1010dd7926_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 2.2MB
- Sample260709-pcjn3aay51
- SHA256 debbe733797cf28ede7fa8bbd830ab50e66f9904de88a0c49b26d304a027536e
- MD5 ceace82d61134d0153f2af1010dd7926
- SHA1 0b850499825afb5eddc1aff65dbc7021def00b18
- SHA512 a479aa83aaf503156e55939d7c83e6bf1c9f689da4c7988278748646dcc5635224dce185f02e88c1f90ed71113ae07135204e801f621f004530e4a5a5f05fe09
- SSDEEP 24576:rv2Bu7i8GdTDb1ncP2Irqc2xXIE2IKcoQhIoNydyTAV+mY1o1VcQyyGJyAV+muLC:rvM8GdTDb1ncP2ImpXIEMcEoU0NeIq
- TLSH T1CCB5F86176E7AA29E4F29434C630E2B144936CE39E2632039E4E9F897E314F547D47B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-09_ceace82d61134d0153f2af1010dd7926_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_ceace82d61134d0153f2af1010dd7926_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 2.2MB
- SHA256 debbe733797cf28ede7fa8bbd830ab50e66f9904de88a0c49b26d304a027536e
- MD5 ceace82d61134d0153f2af1010dd7926
- SHA1 0b850499825afb5eddc1aff65dbc7021def00b18
- SHA512 a479aa83aaf503156e55939d7c83e6bf1c9f689da4c7988278748646dcc5635224dce185f02e88c1f90ed71113ae07135204e801f621f004530e4a5a5f05fe09
- SSDEEP 24576:rv2Bu7i8GdTDb1ncP2Irqc2xXIE2IKcoQhIoNydyTAV+mY1o1VcQyyGJyAV+muLC:rvM8GdTDb1ncP2ImpXIEMcEoU0NeIq
- TLSH T1CCB5F86176E7AA29E4F29434C630E2B144936CE39E2632039E4E9F897E314F547D47B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL