General
- Target 2026-07-09_2f646023a93a96519625f7efdf8e863b_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_medusalocker_njrat_remcos_revil_sliver
- Size 16.8MB
- Sample260709-wddmrsez7m
- SHA256 f87c4b781ad608f1e0508cd5a843a6330623cf837a55ccad47f7db13b5fe0829
- MD5 2f646023a93a96519625f7efdf8e863b
- SHA1 614ea1a9d7aa2417601d3c7994e604bb36253189
- SHA512 7128ab63f246b9b19ed391ea522d72ac78a73dab0e368aaa51e2e7b181067b2d557cf69cf7c2e5fe5fa3c5c0eb9c34fa91ccea160e51ba259db6367351d9a186
- SSDEEP 393216:jOqXgzoctksAvqPQqcAQxYIVacduSGjeX30tAUjXQ:aqRctkZNVanSSAUjA
- TLSH T1CF072311FE42A032F9E300B155BE5BBE583CBA30072890D397D46DBA5A316E27E36757
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-09_2f646023a93a96519625f7efdf8e863b_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_2f646023a93a96519625f7efdf8e863b_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe
Resource
win11ltsc2024-20260706-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_2f646023a93a96519625f7efdf8e863b_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_medusalocker_njrat_remcos_revil_sliver
- Size 16.8MB
- SHA256 f87c4b781ad608f1e0508cd5a843a6330623cf837a55ccad47f7db13b5fe0829
- MD5 2f646023a93a96519625f7efdf8e863b
- SHA1 614ea1a9d7aa2417601d3c7994e604bb36253189
- SHA512 7128ab63f246b9b19ed391ea522d72ac78a73dab0e368aaa51e2e7b181067b2d557cf69cf7c2e5fe5fa3c5c0eb9c34fa91ccea160e51ba259db6367351d9a186
- SSDEEP 393216:jOqXgzoctksAvqPQqcAQxYIVacduSGjeX30tAUjXQ:aqRctkZNVanSSAUjA
- TLSH T1CF072311FE42A032F9E300B155BE5BBE583CBA30072890D397D46DBA5A316E27E36757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.