stealthworker | 2026-05-11_ae47d416641645494ce29b343a64261b_coinminer_elex_glassworm_hive_poet-rat_rex_snatch_zxxz

General

Target
2026-05-11_ae47d416641645494ce29b343a64261b_coinminer_elex_glassworm_hive_poet-rat_rex_snatch_zxxz
Size 6.9MB
Sample260511-t7dhraey71
SHA256 333c78a3f565d231916a0bb92ec46a33bc83eb4ced038ba57e6dfeff2c9d7321
MD5 ae47d416641645494ce29b343a64261b
SHA1 87d39b2711b9d292779446b2a30fad2294842d7b
SHA512 dcfea0dc694be52276af3d9e488a7ce0faec3654c3c7a8315e8ef93b221c52798764db565e414689f61566edb157970559d7c63bc8534a5594a342b04be64732
SSDEEP 49152:p92mic7iMnbPvRUAm+ugRkqjR7Q8TOc5KubExvCsNGEgveIXB4IStNT/IeswF691:emP7i+Rf0es5uKtNTAcSE8sIX
TLSH
T150765C91F9EB15F9E703483095A7623F6730620A8739CECBC7405F96F8675D20A7362A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet stealthworker

Malware Config

Extracted

Family

stealthworker

Version

3.12

C2

http://185.191.32.170:8888

Signatures

Family: StealthWorker
StealthWorker is golang-based brute force malware.
botnet stealthworker

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

StealthWorker payload 1 IoCs

botnet

resource	yara_rule
sample	stealthworker

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-11_ae47d416641645494ce29b343a64261b_coinminer_elex_glassworm_hive_poet-rat_rex_snatch_zxxz

File Explorer

2026-05-11_ae47d416641645494ce29b343a64261b_coinminer_elex_glassworm_hive_poet-rat_rex_snatch_zxxz

.exe 6.9MB

2026-05-11_ae47d416641645494ce29b343a64261b_coinminer_elex_glassworm_hive_poet-rat_rex_snatch_zxxz

SHA256 333c78a3f565d231916a0bb92ec46a33bc83eb4ced038ba57e6dfeff2c9d7321
MD5 ae47d416641645494ce29b343a64261b
SHA1 87d39b2711b9d292779446b2a30fad2294842d7b
SHA512 dcfea0dc694be52276af3d9e488a7ce0faec3654c3c7a8315e8ef93b221c52798764db565e414689f61566edb157970559d7c63bc8534a5594a342b04be64732
SSDEEP 49152:p92mic7iMnbPvRUAm+ugRkqjR7Q8TOc5KubExvCsNGEgveIXB4IStNT/IeswF691:emP7i+Rf0es5uKtNTAcSE8sIX
TLSH
T150765C91F9EB15F9E703483095A7623F6730620A8739CECBC7405F96F8675D20A7362A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
StealthWorker payload

botnet
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7218752

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Sharing