2026-05-28_4a84c1f7b0eaa2bdc2f181682847efc7_coinminer_elex_glassworm_maze_medusalocker_mimic_revil

General

Target
2026-05-28_4a84c1f7b0eaa2bdc2f181682847efc7_coinminer_elex_glassworm_maze_medusalocker_mimic_revil
Size 7.5MB
Sample260528-cbcsxads2j
SHA256 df3e02291322bea7f2811c5e996f8f0a423c81da55231aea27324ca2182b2762
MD5 4a84c1f7b0eaa2bdc2f181682847efc7
SHA1 cad534074b362b698f64897c5019bdf9e6fdaa68
SHA512 62fcd43033c732bf1c82e221e29eee3aa37c18bc6ac8043d0d55322274775198f3c04a1f5af0dc4639773eb537376126abdeeb01c241bfa6e385edea5f8f83ed
SSDEEP 98304:9vij/X0eHogywCDIeq5vQ/qpyr0k7n5xhzSbooDKfL+zDy07yJfzoklSUyKTKK41:92XXDy9CEn5jzzoDy+ZS8kl
TLSH
T18F868D20BE41C575FEC212B296BC6FFE062D9E20073895D7C2D83E6A1E706D31B36596
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx

Malware Config

Signatures

Custom signature

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-28_4a84c1f7b0eaa2bdc2f181682847efc7_coinminer_elex_glassworm_maze_medusalocker_mimic_revil

File Explorer

2026-05-28_4a84c1f7b0eaa2bdc2f181682847efc7_coinminer_elex_glassworm_maze_medusalocker_mimic_revil

.exe 7.5MB

2026-05-28_4a84c1f7b0eaa2bdc2f181682847efc7_coinminer_elex_glassworm_maze_medusalocker_mimic_revil

SHA256 df3e02291322bea7f2811c5e996f8f0a423c81da55231aea27324ca2182b2762
MD5 4a84c1f7b0eaa2bdc2f181682847efc7
SHA1 cad534074b362b698f64897c5019bdf9e6fdaa68
SHA512 62fcd43033c732bf1c82e221e29eee3aa37c18bc6ac8043d0d55322274775198f3c04a1f5af0dc4639773eb537376126abdeeb01c241bfa6e385edea5f8f83ed
SSDEEP 98304:9vij/X0eHogywCDIeq5vQ/qpyr0k7n5xhzSbooDKfL+zDy07yJfzoklSUyKTKK41:92XXDy9CEn5jzzoDy+ZS8kl
TLSH
T18F868D20BE41C575FEC212B296BC6FFE062D9E20073895D7C2D83E6A1E706D31B36596
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4843022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=10, id=199, version=41118,

count=47, id=223, productName=VS2013 build 21005, version=21005,

count=149, id=225, productName=VS2013 build 21005, version=21005,

count=284, id=224, productName=VS2013 build 21005, version=21005,

count=8, id=225, version=20806,

count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=224, version=40679,

count=33, id=225, version=40679,

count=21, productName=Unmarked objects (old),

count=452, id=1, productName=Unmarked objects,

count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=658, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=126, id=228, version=40629,

count=25, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_4a84c1f7b0eaa2bdc2f181682847efc7_coinminer_elex_glassworm_maze_medusalocker_mimic_revil

generic