2026-05-27_d900e9baee7c3dfe2f3b992459ee178c_coinminer_darkgate_elex_glassworm_maze

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-27_d900e9baee7c3dfe2f3b992459ee178c_coinminer_darkgate_elex_glassworm_maze
Size 40.2MB
Sample260527-txwxcaev4v
SHA256 6421d29b02f2e541a5ed3ce42679932cf9085f43ac49377a47def985c279395c
MD5 d900e9baee7c3dfe2f3b992459ee178c
SHA1 1afb7abeb45e9dd24049d0c7037109d44fe4bd10
SHA512 dda711dbf301442c084dfc022fe0768198d4c43723ebec52810f6dfadf054731eb9d97685b04cda31ca0bcf6912c951b985f5c7520f101f77279b5f703293e4a
SSDEEP 786432:zL6MxHDDxHDCPVNSaSCHLHKsCWoecfa+IFofuqwvw92ytNm5MNm58qAJvze:zL6fRHLH5FoGDy
TLSH
T1C397AEDB76C23B82E0F8D9F418AFAC7C619230350726D97D748A6E504139F1963E2E76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-27_d900e9baee7c3dfe2f3b992459ee178c_coinminer_darkgate_elex_glassworm_maze

File Explorer

2026-05-27_d900e9baee7c3dfe2f3b992459ee178c_coinminer_darkgate_elex_glassworm_maze

.exe 40.2MB

2026-05-27_d900e9baee7c3dfe2f3b992459ee178c_coinminer_darkgate_elex_glassworm_maze

IMPHASH a2e278ee464108e7f18a5179692b68aa
SHA256 6421d29b02f2e541a5ed3ce42679932cf9085f43ac49377a47def985c279395c
MD5 d900e9baee7c3dfe2f3b992459ee178c
SHA1 1afb7abeb45e9dd24049d0c7037109d44fe4bd10
SHA512 dda711dbf301442c084dfc022fe0768198d4c43723ebec52810f6dfadf054731eb9d97685b04cda31ca0bcf6912c951b985f5c7520f101f77279b5f703293e4a
SSDEEP 786432:zL6MxHDDxHDCPVNSaSCHLHKsCWoecfa+IFofuqwvw92ytNm5MNm58qAJvze:zL6fRHLH5FoGDy
TLSH
T1C397AEDB76C23B82E0F8D9F418AFAC7C619230350726D97D748A6E504139F1963E2E76
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1978452

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA GetStdHandle GetConsoleScreenBufferInfo SetWaitableTimer QueryPerformanceCounter WaitForSingleObject GetSystemTimeAsFileTime QueryPerformanceFrequency CloseHandle CreateWaitableTimerA FillConsoleOutputCharacterA SetConsoleTextAttribute WriteConsoleW MultiByteToWideChar SetProcessAffinityMask SetPriorityClass GetCurrentProcess SetThreadExecutionState GetCurrentThread FreeConsole GetConsoleWindow SetThreadPriority SetConsoleCtrlHandler GetSystemInfo SetThreadAffinityMask GetLastError FreeLibrary ExpandEnvironmentStringsA TlsAlloc TlsFree TlsGetValue TlsSetValue InitializeCriticalSection DeleteCriticalSection EnterCriticalSection TryEnterCriticalSection LeaveCriticalSection GetCurrentProcessId GetCurrentThreadId CreateSemaphoreA ReleaseSemaphore GetProcAddress CreateEventA WaitForMultipleObjects ResetEvent SetEvent HeapDestroy HeapAlloc HeapFree GetModuleHandleA HeapCreate LocalAlloc GetSystemDirectoryW GetFileAttributesW LocalFree SetLastError LoadLibraryExW lstrcmpW ExpandEnvironmentStringsW GetFullPathNameW VerifyVersionInfoW VerSetConditionMask IsDebuggerPresent DecodePointer EncodePointer FlushConsoleInputBuffer GetVersionExA GlobalMemoryStatus GetVersion GetFileType FormatMessageA GetTickCount VerifyVersionInfoA SleepEx GetSystemDirectoryA SetThreadContext GetThreadContext ResumeThread GetThreadPriority DuplicateHandle Sleep IsProcessorFeaturePresent SwitchToThread

user32

ShowWindow GetProcessWindowStation MessageBoxA GetDesktopWindow GetUserObjectInformationW

ws2_32

connect getsockname WSASetLastError getsockopt WSAStartup WSACleanup inet_ntoa recvfrom inet_addr htonl getpeername ntohs setsockopt sendto bind closesocket listen accept WSAIoctl select WSAGetLastError recv socket send __WSAFDIsSet ioctlsocket freeaddrinfo getaddrinfo shutdown htons

winmm

timeBeginPeriod timeEndPeriod

msvcr120

memset _controlfp_s _invoke_watson __crtSetUnhandledExceptionFilter _except_handler4_common _commode _fmode __initenv _initterm exit __iob_func fprintf floor __RTDynamicCast sscanf ??2@YAPAXI@Z ??3@YAXPAX@Z qsort free malloc _snprintf ??0exception@std@@QAE@ABQBD@Z ??0exception@std@@QAE@ABV01@@Z ??1exception@std@@UAE@XZ ?what@exception@std@@UBEPBDXZ _CxxThrowException __CxxFrameHandler3 _strdup strncmp calloc sprintf tolower printf strrchr _stricmp _strnicmp rand _purecall memcpy strstr _time64 strchr _vsnprintf getenv __daylight __timezone _tzset fopen fwrite fclose strerror _strtoi64 _errno fgetc _vacopy strtod memmove localeconv _dclass _isatty fputs fflush strtol _fileno strspn vfprintf _vscprintf atoi strncpy strtok atol llround strtoul atof rename _mkdir _chdir fread _unlink _getcwd _gmtime64 _getpid srand _ftime64 realloc isspace _localtime64_s memchr strftime _aligned_free _aligned_malloc _localtime64 _splitpath_s _stat64i32 isalpha toupper _difftime64 ??0exception@std@@QAE@ABQBDH@Z ??_V@YAXPAX@Z ?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z feof ferror fseek ftell _beginthreadex wcsrchr _wcsnicmp _wcsicmp isdigit wcsstr _wcsupr strncat_s longjmp _endthreadex _ftime64_s _setjmp3 isxdigit fgets fputc __sys_nerr isalnum _stat64 strcmp raise _exit _wfopen _setmode isupper signal _getch _lock _unlock _calloc_crt __dllonexit _onexit ??1type_info@@UAE@XZ _except1 ?terminate@@YAXXZ _crt_debugger_hook __crtUnhandledException __crtTerminateProcess _XcptFilter _amsg_exit __getmainargs __set_app_type _cexit _configthreadlocale __setusermatherr _initterm_e

advapi32

RegisterEventSourceA ReportEventA DeregisterEventSource

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

573KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

321KB

Virtual Size

32.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.nv_fatb

Size

37.2MB

Virtual Size

37.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.nvFatBi

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ctors

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dtors

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=2, id=221, productName=VS2013 build 21005, version=21005,

count=15, id=223, productName=VS2013 build 21005, version=21005,

count=22, id=224, productName=VS2013 build 21005, version=21005,

count=6, id=199, version=41118,

count=8, id=225, productName=VS2013 build 21005, version=21005,

count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=224, productName=VS2013 UPD3 build 30723, version=30723,

count=8, id=203, version=65501,

count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=402, id=1, productName=Unmarked objects,

count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=171, productName=VS2010 SP1 build 40219, version=40219,

count=128, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=616, id=228, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,