General
- Target 2026-08-22_1a6b82aa0cf8920dffaa71798f39cc75_adposhel_darkgate_elex_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos
- Size 2.1MB
- Sample260823-nyc8qswekh
- SHA256 ccf4bcc5b75718105217dba5391750f528b4f1628271b4f30391d8713f18bc05
- MD5 1a6b82aa0cf8920dffaa71798f39cc75
- SHA1 545aa22e8296f49db72242afebb100dff68fe468
- SHA512 d4cc8f094944a7bc1d4f9643d640b9545812fd1950f9242314518020fe3bd2ff13e0e4cd026068b9cc69e6594d97b5e2a8ca0161d4bdf4c7f6f3239d47f12cd1
- SSDEEP 49152:vvPmarYWMiqJ/ugJ8TzNkwKglepaKkhL3Us0oRiRJyk:vvPmp52g5wKIepaKkhL3Us0oRiRJ
- TLSH T184A5CF217D40C1B6F96302B0A83FBB66497DAD244B7414DBA3C83D3D19B21D36A3676B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_1a6b82aa0cf8920dffaa71798f39cc75_adposhel_darkgate_elex_hijackloader_luca-stealer_medusal.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_1a6b82aa0cf8920dffaa71798f39cc75_adposhel_darkgate_elex_hijackloader_luca-stealer_medusal.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-22_1a6b82aa0cf8920dffaa71798f39cc75_adposhel_darkgate_elex_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos
- Size 2.1MB
- SHA256 ccf4bcc5b75718105217dba5391750f528b4f1628271b4f30391d8713f18bc05
- MD5 1a6b82aa0cf8920dffaa71798f39cc75
- SHA1 545aa22e8296f49db72242afebb100dff68fe468
- SHA512 d4cc8f094944a7bc1d4f9643d640b9545812fd1950f9242314518020fe3bd2ff13e0e4cd026068b9cc69e6594d97b5e2a8ca0161d4bdf4c7f6f3239d47f12cd1
- SSDEEP 49152:vvPmarYWMiqJ/ugJ8TzNkwKglepaKkhL3Us0oRiRJyk:vvPmp52g5wKIepaKkhL3Us0oRiRJ
- TLSH T184A5CF217D40C1B6F96302B0A83FBB66497DAD244B7414DBA3C83D3D19B21D36A3676B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE