General
- Target 2026-08-03_da1df418c375e13ed8e4750a66c32142_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 1.1MB
- Sample260804-ldvk6ssths
- SHA256 37edc8cba4b060726e9d7c6271d4ad743d417bcd07f6bf5be0b3c8a27a486366
- MD5 da1df418c375e13ed8e4750a66c32142
- SHA1 298e35bbe52fb39a09a7eba40f951824cfb411dc
- SHA512 909b9e2b73a1957cbe0b181fecc36bbe29f9aaaabd86f75c128b3ea5f0235367c5f746b977f6f34a08fbc8dcd6dd63d96b49ade2e1dba699e26edae427a87158
- SSDEEP 24576:FHcLr2nKZyR313p6SG+HHJgtQW10J2kEoDYAXteW:Cr2nKZyR313pVbJg71cbt
- TLSH T163359D2277D2813AE6B307314D39E29412BAB9B15E32CA5F67C8161E1FB06519F31B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-03_da1df418c375e13ed8e4750a66c32142_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_da1df418c375e13ed8e4750a66c32142_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 1.1MB
- SHA256 37edc8cba4b060726e9d7c6271d4ad743d417bcd07f6bf5be0b3c8a27a486366
- MD5 da1df418c375e13ed8e4750a66c32142
- SHA1 298e35bbe52fb39a09a7eba40f951824cfb411dc
- SHA512 909b9e2b73a1957cbe0b181fecc36bbe29f9aaaabd86f75c128b3ea5f0235367c5f746b977f6f34a08fbc8dcd6dd63d96b49ade2e1dba699e26edae427a87158
- SSDEEP 24576:FHcLr2nKZyR313p6SG+HHJgtQW10J2kEoDYAXteW:Cr2nKZyR313pVbJg71cbt
- TLSH T163359D2277D2813AE6B307314D39E29412BAB9B15E32CA5F67C8161E1FB06519F31B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL