General
- Target 2026-10-01_13c72975a35e20eab41d83297edbb6ab_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 1.8MB
- Sample261002-ya59qagf27
- SHA256 9141c81715652f4c1cd0b61b4e1e372d3909b3e839c34fcb2240b1d5093bec9c
- MD5 13c72975a35e20eab41d83297edbb6ab
- SHA1 630698a33a87f95ca891615c44f672074ec01739
- SHA512 3775d2277b32eae37a71e1c1e85cc2941eef1937bdac8f42d4bb2365091a72b8065662b77461587f624f020ebed9c4be6d4622bbd2fff13f65cebc961a245a04
- SSDEEP 24576:Kv2Bu7i8GdTDb1ncP2Irqc2xXIE2IKcoQhIjscu7AV+mZcwfydyTAV+mY1o1VcQ:KvM8GdTDb1ncP2ImpXIEMcEjshxb0Ni
- TLSH T13E85F86176E7AA29E4F29438C630E2B144936CE39A1632039E4E9FC97E314F547D47B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_13c72975a35e20eab41d83297edbb6ab_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-01_13c72975a35e20eab41d83297edbb6ab_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 1.8MB
- SHA256 9141c81715652f4c1cd0b61b4e1e372d3909b3e839c34fcb2240b1d5093bec9c
- MD5 13c72975a35e20eab41d83297edbb6ab
- SHA1 630698a33a87f95ca891615c44f672074ec01739
- SHA512 3775d2277b32eae37a71e1c1e85cc2941eef1937bdac8f42d4bb2365091a72b8065662b77461587f624f020ebed9c4be6d4622bbd2fff13f65cebc961a245a04
- SSDEEP 24576:Kv2Bu7i8GdTDb1ncP2Irqc2xXIE2IKcoQhIjscu7AV+mZcwfydyTAV+mY1o1VcQ:KvM8GdTDb1ncP2ImpXIEMcEjshxb0Ni
- TLSH T13E85F86176E7AA29E4F29438C630E2B144936CE39A1632039E4E9FC97E314F547D47B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL