2026-06-26_1e21011f4d2d7a8aecb66951fc7aa2e0_coinminer_elex_glassworm_hive_ngrbot_poet-rat_rex_snatch_zxxz

General

Target
2026-06-26_1e21011f4d2d7a8aecb66951fc7aa2e0_coinminer_elex_glassworm_hive_ngrbot_poet-rat_rex_snatch_zxxz
Size 41.6MB
Sample260629-wbfpcacw6n
SHA256 0695d31006802c7682be17a3b12114b6f9845b374e3a6bf2c54e0fccb12481d8
MD5 1e21011f4d2d7a8aecb66951fc7aa2e0
SHA1 e520964669cae644e8f83aab752530dd22467e30
SHA512 0f4bc7958f0687cfa8059cdbcdaeb05ce6e939bc07973846cf6f6cbb791cb14d73cd9a7785276f7b3d3a241af8cd4be6ef7f8ceef64731d32c01bec5295812ad
SSDEEP 786432:9k4tLslRKp1bluF8x9RI06iNIA2BR3ep3f04Dv:9kcLyRqF
TLSH
T1CEA74A61E99BE0B1EA024431C06BD5FF2B311D068729CA87F68C7E2BFB729D1057751A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Patched UPX-packed file 1 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
sample	patched_upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-26_1e21011f4d2d7a8aecb66951fc7aa2e0_coinminer_elex_glassworm_hive_ngrbot_poet-rat_rex_snatch_zxxz

File Explorer

2026-06-26_1e21011f4d2d7a8aecb66951fc7aa2e0_coinminer_elex_glassworm_hive_ngrbot_poet-rat_rex_snatch_zxxz

.exe 41.6MB