General
- Target 2026-08-13_cec770f70b0f5c61e2e6741d1a14da0a_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 1.1MB
- Sample260814-aev3jszzcz
- SHA256 71b60d087c8e82e4a3a33224e8e51368345dc11d558103be615f3bbacce8ce13
- MD5 cec770f70b0f5c61e2e6741d1a14da0a
- SHA1 c729fab1f299d221c6e77cacc70099437c6e70a2
- SHA512 1bc8f553b315a23359f9cc24efc449fc4e229130c0de450595bb44f0284540c06fcf7d4278c9f7babda4ff94dd451a67abc23709bcf6c65c8d8f661f79f7addb
- SSDEEP 24576:uH+eTWnKZyR313p6S++HvJgtQW1MJ2E2UDY2dvo3:4TWnKZyR313pVzhg71Ejo
- TLSH T1E9359D2676D2813AE6B307314D39E29412BAB9715E32CB5F67C8121E1FB0651AF31B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-13_cec770f70b0f5c61e2e6741d1a14da0a_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-13_cec770f70b0f5c61e2e6741d1a14da0a_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 1.1MB
- SHA256 71b60d087c8e82e4a3a33224e8e51368345dc11d558103be615f3bbacce8ce13
- MD5 cec770f70b0f5c61e2e6741d1a14da0a
- SHA1 c729fab1f299d221c6e77cacc70099437c6e70a2
- SHA512 1bc8f553b315a23359f9cc24efc449fc4e229130c0de450595bb44f0284540c06fcf7d4278c9f7babda4ff94dd451a67abc23709bcf6c65c8d8f661f79f7addb
- SSDEEP 24576:uH+eTWnKZyR313p6S++HvJgtQW1MJ2E2UDY2dvo3:4TWnKZyR313pVzhg71Ejo
- TLSH T1E9359D2676D2813AE6B307314D39E29412BAB9715E32CB5F67C8121E1FB0651AF31B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL