General
- Target 2026-10-22_6d86c0d449dbbbe736ccc15969498f49_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 2.2MB
- Sample261024-lffj2aaz2k
- SHA256 f86ebeb2fac7f13cefc4183f9940a25c33df797f081146b413c49d8101908402
- MD5 6d86c0d449dbbbe736ccc15969498f49
- SHA1 5aa6498a85b235b683341fbb168db2dfc2a1b185
- SHA512 8166c2e6e4db2cd6d000999fe82869f95756d06f3c438d126a76f2be52fb3f78d36ba90e6e087b37d71fc8688ce17c09751062d7ae42a3319b4ad7f9141564a1
- SSDEEP 24576:rv2Bu7i8GdTDb1ncP2Irqc2xXIE2IKcoQhIoNydyTAV+mY1o1VcQyyGJyAV+muLC:rvM8GdTDb1ncP2ImpXIEMcEoU0NeIq
- TLSH T1A9B5F86176E7AA29E4F29434C630E2B144936CE39E2632039E4E9F897E314F547D47B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-22_6d86c0d449dbbbe736ccc15969498f49_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260911-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-22_6d86c0d449dbbbe736ccc15969498f49_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 2.2MB
- SHA256 f86ebeb2fac7f13cefc4183f9940a25c33df797f081146b413c49d8101908402
- MD5 6d86c0d449dbbbe736ccc15969498f49
- SHA1 5aa6498a85b235b683341fbb168db2dfc2a1b185
- SHA512 8166c2e6e4db2cd6d000999fe82869f95756d06f3c438d126a76f2be52fb3f78d36ba90e6e087b37d71fc8688ce17c09751062d7ae42a3319b4ad7f9141564a1
- SSDEEP 24576:rv2Bu7i8GdTDb1ncP2Irqc2xXIE2IKcoQhIoNydyTAV+mY1o1VcQyyGJyAV+muLC:rvM8GdTDb1ncP2ImpXIEMcEoU0NeIq
- TLSH T1A9B5F86176E7AA29E4F29434C630E2B144936CE39E2632039E4E9F897E314F547D47B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL