General
- Target 2026-10-26_748ebec4e4224548d6183e7328d03397_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 1.8MB
- Sample261027-rtmhdsdg59
- SHA256 c76578c317fb7ec839412333c2709eab1752d37775f2d5f733c944192c4bf8a0
- MD5 748ebec4e4224548d6183e7328d03397
- SHA1 a9a758ee0f7f7097521186fd2c00aefae5896077
- SHA512 79b56fa9896ed3a26ba85b92d0f649b7dadf11c0ae211e3017a78ebcb73b9bb7a9094e13fa04a7394b42419e4af5f591a6401d950f439b70fbd0edb43f3ded98
- SSDEEP 24576:Kv2Bu7i8GdTDb1ncP2Irqc2xXIE2IKcoQhIjscu7AV+mZcwfydyTAV+mY1o1VcQ:KvM8GdTDb1ncP2ImpXIEMcEjshxb0Ni
- TLSH T19185F86176E7AA29E4F29438C630E2B144936CE39A1632039E4E9FC97E314F547D47B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_748ebec4e4224548d6183e7328d03397_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-26_748ebec4e4224548d6183e7328d03397_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 1.8MB
- SHA256 c76578c317fb7ec839412333c2709eab1752d37775f2d5f733c944192c4bf8a0
- MD5 748ebec4e4224548d6183e7328d03397
- SHA1 a9a758ee0f7f7097521186fd2c00aefae5896077
- SHA512 79b56fa9896ed3a26ba85b92d0f649b7dadf11c0ae211e3017a78ebcb73b9bb7a9094e13fa04a7394b42419e4af5f591a6401d950f439b70fbd0edb43f3ded98
- SSDEEP 24576:Kv2Bu7i8GdTDb1ncP2Irqc2xXIE2IKcoQhIjscu7AV+mZcwfydyTAV+mY1o1VcQ:KvM8GdTDb1ncP2ImpXIEMcEjshxb0Ni
- TLSH T19185F86176E7AA29E4F29438C630E2B144936CE39A1632039E4E9FC97E314F547D47B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL