General
- Target 2026-10-26_6425746b048dbc08c7765fdd82e8f682_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 1.8MB
- Sample261027-taa2cse19j
- SHA256 f633dd4599b7e0695a900f0f89b16037fecb86128dfab9cddf0239d856e8ddbc
- MD5 6425746b048dbc08c7765fdd82e8f682
- SHA1 35c0c5596c0b914f5ceb7f8d47cdcaebe2534c8d
- SHA512 10437241d120e393df852051756b7a37d7c646a1e99ee188df6b50ce981854b9745ab82ceaacedbf010be41449d17b7805eee72478ba64c7dc4f2bdc9f6e6edb
- SSDEEP 24576:Kv2Bu7i8GdTDb1ncP2Irqc2xXIE2IKcoQhIjscu7AV+mZcwfydyTAV+mY1o1VcQ:KvM8GdTDb1ncP2ImpXIEMcEjshxb0Ni
- TLSH T1A385F86176E7AA29E4F29438C630E2B144936CE39A1632039E4E9FC97E314F547D47B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_6425746b048dbc08c7765fdd82e8f682_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-26_6425746b048dbc08c7765fdd82e8f682_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 1.8MB
- SHA256 f633dd4599b7e0695a900f0f89b16037fecb86128dfab9cddf0239d856e8ddbc
- MD5 6425746b048dbc08c7765fdd82e8f682
- SHA1 35c0c5596c0b914f5ceb7f8d47cdcaebe2534c8d
- SHA512 10437241d120e393df852051756b7a37d7c646a1e99ee188df6b50ce981854b9745ab82ceaacedbf010be41449d17b7805eee72478ba64c7dc4f2bdc9f6e6edb
- SSDEEP 24576:Kv2Bu7i8GdTDb1ncP2Irqc2xXIE2IKcoQhIjscu7AV+mZcwfydyTAV+mY1o1VcQ:KvM8GdTDb1ncP2ImpXIEMcEjshxb0Ni
- TLSH T1A385F86176E7AA29E4F29438C630E2B144936CE39A1632039E4E9FC97E314F547D47B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL