2026-05-11_12b58820325a0887e24562cf7c53e62b_coinminer_elex_glassworm_mafia

General

Target
2026-05-11_12b58820325a0887e24562cf7c53e62b_coinminer_elex_glassworm_mafia
Size 5.0MB
Sample260511-th4cwad121
SHA256 9db3d9f8d2d082917b7cb48c4da1ff49568213c7ef0759d0f4f72e9c9c9deb0a
MD5 12b58820325a0887e24562cf7c53e62b
SHA1 08bf009109a259bb6791c99e767311091d2c7fd6
SHA512 3739279a12abe849cdc67fcce78e7e312b92ca232ee0075ed6facc0c3265332601356104cf04a161e1144c89a1b7cd2299b8859700efe112ffb21f6c07a7eede
SSDEEP 98304:5hnUCN/8V7KpbI+rV8+YmujuPpGPdl8yNacNLdoTrWL0nrDBmmhjmF5oguF/otKg:5ilV7KpbI+rV1MlaydLeF/otKVXwqhpi
TLSH
T19C369F12B781813AD5B71972897F96BF5338AD20073456C363D43E3A6F76AC22A3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-11_12b58820325a0887e24562cf7c53e62b_coinminer_elex_glassworm_mafia

File Explorer

2026-05-11_12b58820325a0887e24562cf7c53e62b_coinminer_elex_glassworm_mafia

.exe 5.0MB

2026-05-11_12b58820325a0887e24562cf7c53e62b_coinminer_elex_glassworm_mafia

SHA256 9db3d9f8d2d082917b7cb48c4da1ff49568213c7ef0759d0f4f72e9c9c9deb0a
MD5 12b58820325a0887e24562cf7c53e62b
SHA1 08bf009109a259bb6791c99e767311091d2c7fd6
SHA512 3739279a12abe849cdc67fcce78e7e312b92ca232ee0075ed6facc0c3265332601356104cf04a161e1144c89a1b7cd2299b8859700efe112ffb21f6c07a7eede
SSDEEP 98304:5hnUCN/8V7KpbI+rV8+YmujuPpGPdl8yNacNLdoTrWL0nrDBmmhjmF5oguF/otKg:5ilV7KpbI+rV1MlaydLeF/otKVXwqhpi
TLSH
T19C369F12B781813AD5B71972897F96BF5338AD20073456C363D43E3A6F76AC22A3534B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

1826289

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

libssh2_banner_set libssh2_base64_decode libssh2_channel_close libssh2_channel_direct_tcpip_ex libssh2_channel_eof libssh2_channel_flush_ex libssh2_channel_forward_accept libssh2_channel_forward_cancel libssh2_channel_forward_listen_ex libssh2_channel_free libssh2_channel_get_exit_signal libssh2_channel_get_exit_status libssh2_channel_handle_extended_data libssh2_channel_handle_extended_data2 libssh2_channel_open_ex libssh2_channel_process_startup libssh2_channel_read_ex libssh2_channel_receive_window_adjust libssh2_channel_receive_window_adjust2 libssh2_channel_request_pty_ex libssh2_channel_request_pty_size_ex libssh2_channel_send_eof libssh2_channel_set_blocking libssh2_channel_setenv_ex libssh2_channel_wait_closed libssh2_channel_wait_eof libssh2_channel_window_read_ex libssh2_channel_window_write_ex libssh2_channel_write_ex libssh2_channel_x11_req_ex libssh2_exit libssh2_free libssh2_hostkey_hash libssh2_init libssh2_keepalive_config libssh2_keepalive_send libssh2_poll libssh2_poll_channel_read libssh2_session_abstract libssh2_session_block_directions libssh2_session_callback_set libssh2_session_disconnect_ex libssh2_session_flag libssh2_session_free libssh2_session_get_blocking libssh2_session_get_timeout libssh2_session_handshake libssh2_session_hostkey libssh2_session_init_ex libssh2_session_last_errno libssh2_session_last_error libssh2_session_method_pref libssh2_session_methods libssh2_session_set_blocking libssh2_session_set_timeout libssh2_session_startup libssh2_trace libssh2_trace_sethandler libssh2_userauth_authenticated libssh2_userauth_hostbased_fromfile_ex libssh2_userauth_keyboard_interactive_ex libssh2_userauth_list libssh2_userauth_password_ex libssh2_userauth_publickey libssh2_userauth_publickey_fromfile_ex

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-11_12b58820325a0887e24562cf7c53e62b_coinminer_elex_glassworm_mafia

generic