General
- Target 2026-09-19_11aa86f35785e942021982993d7629e0_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_ransomhub_remcos
- Size 2.6MB
- Sample260919-tls2baha84
- SHA256 77e561778755bf3993e7acc32c35f9b256be5a65fb86d0390d56ad09e0b222aa
- MD5 11aa86f35785e942021982993d7629e0
- SHA1 097b73b9420a97d7abf7afd1c3223be95b41ad13
- SHA512 b9ca6e4bb36aad55340747347ce005f5ee99b6db68da4246913e89b7e2e19ebc5d367dce970ccc875391cfad567b2f62bc48798edd894e71cc74744e0651529c
- SSDEEP 49152:0ZMZhevSINfmrPEuCZ4mvMyAPNTJmFo2uoEkGaMUolS3e7:dZhevv3uChvee0oEkGX
- TLSH T17ED5CF337390C0F5D1621574697CAB6A99BDBF300B2589C7B3803E2C6DB1AC39535A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Static task
static1
Behavioral task
behavioral1
Sample
2026-09-19_11aa86f35785e942021982993d7629e0_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_ransomhub_remcos.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-19_11aa86f35785e942021982993d7629e0_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_ransomhub_remcos.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-19_11aa86f35785e942021982993d7629e0_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_ransomhub_remcos
- Size 2.6MB
- SHA256 77e561778755bf3993e7acc32c35f9b256be5a65fb86d0390d56ad09e0b222aa
- MD5 11aa86f35785e942021982993d7629e0
- SHA1 097b73b9420a97d7abf7afd1c3223be95b41ad13
- SHA512 b9ca6e4bb36aad55340747347ce005f5ee99b6db68da4246913e89b7e2e19ebc5d367dce970ccc875391cfad567b2f62bc48798edd894e71cc74744e0651529c
- SSDEEP 49152:0ZMZhevSINfmrPEuCZ4mvMyAPNTJmFo2uoEkGaMUolS3e7:dZhevv3uChvee0oEkGX
- TLSH T17ED5CF337390C0F5D1621574697CAB6A99BDBF300B2589C7B3803E2C6DB1AC39535A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score5/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory