General
- Target 2026-07-29_19fc52b8de362ded85b51d759d6f2185_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 1003KB
- Sample260729-ne3dhsfj5t
- SHA256 1f356c5fd3a1af259bf00edbd3ea9702f0b740eaebfbc46ef67801917acb2035
- MD5 19fc52b8de362ded85b51d759d6f2185
- SHA1 c3f5473b9188a92d3891af1c41d181f7c69c6f9b
- SHA512 d10e9c3a195cdd0241c3cefd69fb561707e07415300fe96bbf32a31410b1be0aa212cb8bc3c9dc748470d607a2cd00a995234abeec1388b53aeb092d71c10d8d
- SSDEEP 24576:ucv1JM69EdKdwmHpdWs629lPGQ7ad1rGgr3PjhJ3s8PdRRDYXaXf3nsf:37M69EdKdwmHpdnHyQQ17NJ371jXfu
- TLSH T1C3259D2677E2803AE6B307304D79A29416BFB9325E32CA5F67C4160D5FB0651AF21B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_19fc52b8de362ded85b51d759d6f2185_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-29_19fc52b8de362ded85b51d759d6f2185_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 1003KB
- SHA256 1f356c5fd3a1af259bf00edbd3ea9702f0b740eaebfbc46ef67801917acb2035
- MD5 19fc52b8de362ded85b51d759d6f2185
- SHA1 c3f5473b9188a92d3891af1c41d181f7c69c6f9b
- SHA512 d10e9c3a195cdd0241c3cefd69fb561707e07415300fe96bbf32a31410b1be0aa212cb8bc3c9dc748470d607a2cd00a995234abeec1388b53aeb092d71c10d8d
- SSDEEP 24576:ucv1JM69EdKdwmHpdWs629lPGQ7ad1rGgr3PjhJ3s8PdRRDYXaXf3nsf:37M69EdKdwmHpdnHyQQ17NJ371jXfu
- TLSH T1C3259D2677E2803AE6B307304D79A29416BFB9325E32CA5F67C4160D5FB0651AF21B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL