General
- Target 2026-08-06_14d3393ae40fb6e1d879688cb32984bb_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 2.4MB
- Sample260806-eahnwadj3t
- SHA256 8e2ec27d87851f4893b82cf523a130aa2dc02217da284675096bfa69a79f8ba7
- MD5 14d3393ae40fb6e1d879688cb32984bb
- SHA1 f6360e3e568062cc0fe5da45f91251ebafefb022
- SHA512 bf7306c18fdcfa726c24aebe7d6c90980f5a0002b7178b35b721ca00c600cf1c831de8b4618e5343a873fc49c9bd73711cfd8611fc42fa2b613525433b55d0c0
- SSDEEP 49152:8OMFLbaFbFgqiGNoJVil8V1VfO3YPfMM:oTqQpOInM
- TLSH T139C55C017681C83BC6720730CCB5D2F82579BD98ED224B5F7688FF9F3E316426A91669
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-06_14d3393ae40fb6e1d879688cb32984bb_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-06_14d3393ae40fb6e1d879688cb32984bb_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 2.4MB
- SHA256 8e2ec27d87851f4893b82cf523a130aa2dc02217da284675096bfa69a79f8ba7
- MD5 14d3393ae40fb6e1d879688cb32984bb
- SHA1 f6360e3e568062cc0fe5da45f91251ebafefb022
- SHA512 bf7306c18fdcfa726c24aebe7d6c90980f5a0002b7178b35b721ca00c600cf1c831de8b4618e5343a873fc49c9bd73711cfd8611fc42fa2b613525433b55d0c0
- SSDEEP 49152:8OMFLbaFbFgqiGNoJVil8V1VfO3YPfMM:oTqQpOInM
- TLSH T139C55C017681C83BC6720730CCB5D2F82579BD98ED224B5F7688FF9F3E316426A91669
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL