f23d282a1ac1e45f6fb82ac08c5fd1dcb8e58f34feede7712cd557c9a7a5a98d | Triage™

Login
Reports

Overview

overview

7

Static

static

3

2026-09-16...r_.exe

windows10-2004-x64

7

2026-09-16...r_.exe

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_ea556628b02b7a20ce6a38ba8c2d3efb_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_remcos_revil
Size 4.4MB
Sample260916-j5devsxdnf
SHA256 f23d282a1ac1e45f6fb82ac08c5fd1dcb8e58f34feede7712cd557c9a7a5a98d
MD5 ea556628b02b7a20ce6a38ba8c2d3efb
SHA1 8d87365318f06464a66c53ebdb2b5cc08195ee92
SHA512 9f73866a2d4939b528969c1ed5e9bda7c07d751a69b898346cedb44c1422adb7fefb589272605a664894a5ba381723fd7879ff068c017533515396d380be0821
SSDEEP 49152:+fNrbjA4R3Z5ccMOo6arArTF4gRZBzYFBV2sL4OpzZvGIWImVs1txvCLwT+hl3l7:+fNrA46twrTFzIWZVqSJAbfwAofFm
TLSH
T152266C32FA8B4C73D5911276496F76669A6F6E10072187C3A2D82BE92F301D13E3735E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2026-09-16_ea556628b02b7a20ce6a38ba8c2d3efb_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

14 signatures

150 seconds

discovery ransomware spyware stealer

Behavioral task

behavioral2

Sample

2026-09-16_ea556628b02b7a20ce6a38ba8c2d3efb_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

12 signatures

150 seconds

discovery spyware stealer

Malware Config

Targets

- Target
  2026-09-16_ea556628b02b7a20ce6a38ba8c2d3efb_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_remcos_revil
- Size 4.4MB
- SHA256 f23d282a1ac1e45f6fb82ac08c5fd1dcb8e58f34feede7712cd557c9a7a5a98d
- MD5 ea556628b02b7a20ce6a38ba8c2d3efb
- SHA1 8d87365318f06464a66c53ebdb2b5cc08195ee92
- SHA512 9f73866a2d4939b528969c1ed5e9bda7c07d751a69b898346cedb44c1422adb7fefb589272605a664894a5ba381723fd7879ff068c017533515396d380be0821
- SSDEEP 49152:+fNrbjA4R3Z5ccMOo6arArTF4gRZBzYFBV2sL4OpzZvGIWImVs1txvCLwT+hl3l7:+fNrA46twrTFzIWZVqSJAbfwAofFm
- TLSH
  T152266C32FA8B4C73D5911276496F76669A6F6E10072187C3A2D82BE92F301D13E3735E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomwarespywarestealer

behavioral2

discoveryspywarestealer

© 2018-2026

Terms | Privacy