General
- Target 2026-10-28_9d3ce8f59b749a38f9029dab7791be59_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 2.2MB
- Sample261029-2kl6datx6r
- SHA256 99a4d03fa83b049a3117be765645e81e5f90b8f4b906f1be1f29d2118a1100bd
- MD5 9d3ce8f59b749a38f9029dab7791be59
- SHA1 17dad6108b682a442903500f196469adbe3639fc
- SHA512 93a5c647cbb435343a98a80c3f2cebebd6eb4e3704b97de6d5119748cd4b2af37d819c52cec8fad01689eb80e381ecc53b1ef8c8bdcbf2c346f000a13f3e5fbc
- SSDEEP 24576:rv2Bu7i8GdTDb1ncP2Irqc2xXIE2IKcoQhIoNydyTAV+mY1o1VcQyyGJyAV+muLC:rvM8GdTDb1ncP2ImpXIEMcEoU0NeIq
- TLSH T137B5F86176E7AA29E4F29434C630E2B144936CE39E2632039E4E9F897E314F547D47B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-28_9d3ce8f59b749a38f9029dab7791be59_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260911-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-28_9d3ce8f59b749a38f9029dab7791be59_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
- Size 2.2MB
- SHA256 99a4d03fa83b049a3117be765645e81e5f90b8f4b906f1be1f29d2118a1100bd
- MD5 9d3ce8f59b749a38f9029dab7791be59
- SHA1 17dad6108b682a442903500f196469adbe3639fc
- SHA512 93a5c647cbb435343a98a80c3f2cebebd6eb4e3704b97de6d5119748cd4b2af37d819c52cec8fad01689eb80e381ecc53b1ef8c8bdcbf2c346f000a13f3e5fbc
- SSDEEP 24576:rv2Bu7i8GdTDb1ncP2Irqc2xXIE2IKcoQhIoNydyTAV+mY1o1VcQyyGJyAV+muLC:rvM8GdTDb1ncP2ImpXIEMcEoU0NeIq
- TLSH T137B5F86176E7AA29E4F29434C630E2B144936CE39E2632039E4E9F897E314F547D47B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL