General
- Target 2026-10-01_2b21e882a975b3b36fe3d78e729c262a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_revil
- Size 6.4MB
- Sample261002-v8psvasdra
- SHA256 5ca86bf98796ffff52921409e9fd3d087ff75bd1637d9c42d456573a78f4c557
- MD5 2b21e882a975b3b36fe3d78e729c262a
- SHA1 ad3a47efc16454e993cfbd6d528446bfb71ade42
- SHA512 3b99a1d5581b27c1908a89134f29087be776c954dcd8ef7736218c2dc0430da8b67773e752c33325d76195802387c6aa4fbb63d68d96b76ac63f6b8345e671ca
- SSDEEP 98304:gi276eUBIAFUnQodoR2qUY+nffNo+QihpdXpdPctR+PDDvYDxUHRGm2B3uFWH:gv/UBNvodoRYNrhpDdpDwWEnduF
- TLSH T145669E02B9E18475E57302323A65B356EDBDA9629B3194CFB38C162F0F709C1973BB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_2b21e882a975b3b36fe3d78e729c262a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_me.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_2b21e882a975b3b36fe3d78e729c262a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_me.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-01_2b21e882a975b3b36fe3d78e729c262a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_revil
- Size 6.4MB
- SHA256 5ca86bf98796ffff52921409e9fd3d087ff75bd1637d9c42d456573a78f4c557
- MD5 2b21e882a975b3b36fe3d78e729c262a
- SHA1 ad3a47efc16454e993cfbd6d528446bfb71ade42
- SHA512 3b99a1d5581b27c1908a89134f29087be776c954dcd8ef7736218c2dc0430da8b67773e752c33325d76195802387c6aa4fbb63d68d96b76ac63f6b8345e671ca
- SSDEEP 98304:gi276eUBIAFUnQodoR2qUY+nffNo+QihpdXpdPctR+PDDvYDxUHRGm2B3uFWH:gv/UBNvodoRYNrhpDdpDwWEnduF
- TLSH T145669E02B9E18475E57302323A65B356EDBDA9629B3194CFB38C162F0F709C1973BB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.