c076a16946c29819851e5a89578b198ca5a879c87cf18ff3ffdecb07a03ee2a0

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-25_8be74715a85c031887cd352ab119a20b_coinminer_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee
Size 1.9MB
Sample260425-e5aazsfv2w
SHA256 c076a16946c29819851e5a89578b198ca5a879c87cf18ff3ffdecb07a03ee2a0
MD5 8be74715a85c031887cd352ab119a20b
SHA1 31d3fc7ec6db1395e288c3ab905c175d2bc08e9a
SHA512 ecda3a7badfacf062b4cb77b29c1bcda3cec12070a7127cdcb3eb3998ba1f9ca553bc96e5261b372e877ef09924be9bc771e3e5895a8f1b5df36a0f16395b5ee
SSDEEP 12288:1wKfOVRo9yRYaeCoMLm44O8b8ITDnlz0qUjD5qXIORo:1xWVeyRYhnMLm44O8b8ITDnlzHRo
TLSH
T199959302B9B39161C99EBEF755664BA4E2327D0629903EC67D783F0DEB323609D13E05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  2026-04-25_8be74715a85c031887cd352ab119a20b_coinminer_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee
- Size 1.9MB
- SHA256 c076a16946c29819851e5a89578b198ca5a879c87cf18ff3ffdecb07a03ee2a0
- MD5 8be74715a85c031887cd352ab119a20b
- SHA1 31d3fc7ec6db1395e288c3ab905c175d2bc08e9a
- SHA512 ecda3a7badfacf062b4cb77b29c1bcda3cec12070a7127cdcb3eb3998ba1f9ca553bc96e5261b372e877ef09924be9bc771e3e5895a8f1b5df36a0f16395b5ee
- SSDEEP 12288:1wKfOVRo9yRYaeCoMLm44O8b8ITDnlz0qUjD5qXIORo:1xWVeyRYhnMLm44O8b8ITDnlzHRo
- TLSH
  T199959302B9B39161C99EBEF755664BA4E2327D0629903EC67D783F0DEB323609D13E05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  .rsrc/1033/HTML/AULICENSECHANGE.HTML
- Size 2KB
- SHA256 cded4eb1ba52eac01ab6ac71e658e8673b1622396ad71079bd897cb8c3226f02
- MD5 f99657ea33f67face5470ff4a5771007
- SHA1 2e960cb9b8a62af44a11354820a2d5be64c1e49c
- SHA512 2b0b590c66dc140d58e310a927bd5a33b7bff688b61ba0323224b5c2a0c74dd1e732586d65d9d4e766c54c54a5392c4db1ce3c588a9344414cf550633bda1a0d
- TLSH
  T10941310DACE9D9128150D0E1F4F2FD9FA081D21AC38A5D54B5EC44AB9FC6BDDCC17654
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  .rsrc/1033/HTML/AUWELCOME.HTML
- Size 3KB
- SHA256 f264387739979a9e8683682ced5b539211b051f3d8d6b3b5fa6912efbb8591a4
- MD5 b7cda1f5ab4cd32381f522d8680897f9
- SHA1 e20623be30c92f0c483520c589fa9d617d7a0fea
- SHA512 e71fe1d527d9306322db91ac600d83c59e9e8fedefb9a43d474c31bf5eb11ab440d8e47f74af0aa416f35311144fb9412af2be91140af962576da6c39dcf9918
- TLSH
  T17C815529A8FAD43184D5CA95F6BAEE0F7041E21AC3849D047AFC40A74FD5FDDC8476A8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  .rsrc/1033/HTML/HOST.JS
- Size 1KB
- SHA256 1e67043252582aea0e042f5a7be4a849b7cd01b133a489c3b2e67c10ade086f3
- MD5 a752a4469ac0d91dd2cb1b766ba157de
- SHA1 724ae6b6d6063306cc53b6ad07be6f88eaffbab3
- SHA512 abc2899705a23f15862acf3d407b700bb91c545722c02c7429745ab7f722507285c62614dcb87ea846f88fc0779345cb2e22dc3ad5f8113f6907821505be2c02
- TLSH
  T10A21CBAC1AE8B2809AA375B5882F110E7539C147700E6D507C4CA3D48F2147C61ABD7C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  .rsrc/1033/HTML/L10N.JS
- Size 4KB
- SHA256 85bbec802e8624e7081abeae4f30bd98d9a9df6574bd01fe5251047e8fdaf59f
- MD5 1fd5111b757493a27e697d57b351bb56
- SHA1 9ca81a74fa5c960f4e8b3ad8a0e1ec9f55237711
- SHA512 80f532e4671d685fa8360ef47a09efcb3342bcfcf929170275465f9800bfbfffc35728a1ba496d4c04a1fdefb2776af02262c3774f83fea289585a5296d560b0
- SSDEEP 96:4t/V3qoC44l4idyrsftEHNa2AmgERLJvQJqi3qKeVvEEik6mYh34HvTviDGQP:gCbl4idyrsftPBEnvPsqzdEEik6PhGv4
- TLSH
  T13DA1511C26E924727B8730798DDF6008717685472819DC217C8D9398EFA1638A6ADFFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  .rsrc/1033/HTML/LAYOUT.JS
- Size 2KB
- SHA256 fab91ced243da62ec1d938503fa989462374df470be38707fbf59f73715af058
- MD5 cc86b13a186fa96dfc6480a8024d2275
- SHA1 d892a7f06dc12a0f2996cc094e0730fe14caf51a
- SHA512 0e3e4c9755aa8377e00fc9998faab0cd839dfa9f88ce4f4a46d8b5aaf7a33e59e26dbf55e9e7d1f8ef325d43302c68c44216adb565913d30818c159a182120fc
- TLSH
  T11141EA6E74D999B12EAF313A9A1F601C743250035008EC82BC0DE2C08F71D7112D7AFD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  .rsrc/1033/HTML/RTUTILS.JS
- Size 244B
- SHA256 7da9aa32aa10b69f34b9d3602a3b8a15eb7c03957512714392f12458726ac5f1
- MD5 c0a4cebb2c15be8262bf11de37606e07
- SHA1 cafc2ccb797df31eecd3ae7abd396567de8e736d
- SHA512 cc68f4bc22601430a77258c1d7e18d6366b6bf8f707d31933698b2008092ba5348c33fa8b03e18c4c707abf20ce3cbcb755226dc6489d2b19833809c98a11c74
- TLSH
  T154D097BFA2F5F9220A9DB3336126CC4CFA2E2082342520436D88C0D8FC238A09005C20
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  .rsrc/1033/HTML/RUNTIME.JS
- Size 41KB
- SHA256 f1232b6fe2aa6ea60238b43b347e4d96ecb828e33708dbed05084d9f7e2705bc
- MD5 7ac033d282f74f66f2a09507c49c587c
- SHA1 14c865e0fc6be9a1a399989692613d1989d3e5da
- SHA512 7383643069e6d4d71254bfa9f4bd8bc38841f84c22e4b72d5cf8683cb80751f87c0e6ad02c41b097b0b5bc3a585f3fa0dfd3cebd3174afc7d4ab8c89bc32ac07
- SSDEEP 768:RZu8Ii9eRo5gLoh8QDAKkFsuAQo+6G52cZLh6bQTMtr7N:2jbBQDxuAQo+6CAQG
- TLSH
  T1511360586DF670629A17F2B8495F9109F2B4D497910C8950BC8CB3E0AFA147843BEFED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16