2026-07-01_29532a57b186f102a0660495502258f6_coinminer_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-01_29532a57b186f102a0660495502258f6_coinminer_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil
Size 2.2MB
Sample260701-pcdstafw3s
SHA256 5a90565dccbf65f2cf69c94f3b9db904e037b9bc367050465e070efdf0761a09
MD5 29532a57b186f102a0660495502258f6
SHA1 037919ae67905bf23c7e1de1bd239dbea693efc0
SHA512 412ecc293400384b9f346a15324b7228f06ea1450842abb55241e65cd52da8c915b22de634d43588e8b0de3c69d5cb1553aa43a669029cd97e236edbb1ffb727
SSDEEP 49152:QiIqACA4pqkiVp2oCuJ5OR4xGQPUn+KVAeMq7KMtYr+E:QiIqAX49TRVZn+/eo
TLSH
T1C9B58D03FAC18871E682037959A7273B8A3E65E4A3A4B6D387D01A69CF335D1763F354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-01_29532a57b186f102a0660495502258f6_coinminer_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

.exe 2.2MB

2026-07-01_29532a57b186f102a0660495502258f6_coinminer_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

IMPHASH 7397e9e1fd0f51f150a075a1daf35751
SHA256 5a90565dccbf65f2cf69c94f3b9db904e037b9bc367050465e070efdf0761a09
MD5 29532a57b186f102a0660495502258f6
SHA1 037919ae67905bf23c7e1de1bd239dbea693efc0
SHA512 412ecc293400384b9f346a15324b7228f06ea1450842abb55241e65cd52da8c915b22de634d43588e8b0de3c69d5cb1553aa43a669029cd97e236edbb1ffb727
SSDEEP 49152:QiIqACA4pqkiVp2oCuJ5OR4xGQPUn+KVAeMq7KMtYr+E:QiIqAX49TRVZn+/eo
TLSH
T1C9B58D03FAC18871E682037959A7273B8A3E65E4A3A4B6D387D01A69CF335D1763F354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

f5:ae:2a:93:9a:c3:90:f5:2d:23:f3:ab:d4:87:83:cb:10:78:31:a1:e8:32:67:1e:fd:f9:d2:ad:e4:d8:21:6a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=913100006317722856,CN=Shanghai Orient Webcasting Co.\, Ltd.,O=Shanghai Orient Webcasting Co.\, Ltd.,ST=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c09e4b88ae6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jun 17, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0c:d7:af:1e:13:3e:af:9a:7e:18:d9:bb:96:c0:12:88

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 17, 2026 - Mar 28, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1377500

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetDriveTypeW HeapFree HeapSize HeapReAlloc HeapAlloc GetProcessHeap WideCharToMultiByte GetCurrentProcessId FindFirstFileW FindNextFileW GetModuleFileNameW InitializeCriticalSection FindClose GetDiskFreeSpaceExW EnterCriticalSection LeaveCriticalSection WaitForSingleObject CreateEventW GetExitCodeThread Sleep SetEvent TerminateThread CreateThread CreateDirectoryW GetEnvironmentVariableW GetTempPathW GetLogicalDriveStringsW CreateFileA DeleteFileW MoveFileExW CopyFileW GetTickCount ReadFile LocalFree GetLongPathNameW WriteFile ProcessIdToSessionId FileTimeToSystemTime GetFileSize CreateProcessW Process32FirstW Process32NextW GetPrivateProfileStringW CreateToolhelp32Snapshot OpenProcess LocalAlloc SetEndOfFile SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetSystemDirectoryW GetVolumeInformationW FreeLibrary GetProcAddress LoadLibraryW CloseHandle GetVersionExW CreateFileW DeviceIoControl OutputDebugStringA GetCurrentProcess SetPriorityClass DeleteCriticalSection DecodePointer RaiseException GetLastError GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle GetFullPathNameW GetCurrentDirectoryW InitializeCriticalSectionAndSpinCount FlushFileBuffers GetTimeZoneInformation GetConsoleCP GetACP SetConsoleCtrlHandler ExitProcess SetFilePointerEx ExitThread SystemTimeToTzSpecificLocalTime FindFirstFileExW WriteConsoleW RtlUnwind LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetCurrentThreadId WaitForSingleObjectEx GetCurrentThread EncodePointer QueryPerformanceCounter SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW CompareStringW LCMapStringW GetStringTypeW GetCPInfo IsDebuggerPresent OutputDebugStringW FormatMessageA SleepEx WaitForMultipleObjects GetFileType GetStdHandle PeekNamedPipe ExpandEnvironmentStringsA VerSetConditionMask LoadLibraryA GetModuleHandleA GetSystemDirectoryA VerifyVersionInfoA GetModuleHandleExW TerminateProcess SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW wsprintfW

advapi32

RegCloseKey LookupPrivilegeValueW GetSidSubAuthorityCount GetSidSubAuthority CreateProcessAsUserW DuplicateTokenEx ReportEventW RegCreateKeyExW RegSetValueExW OpenProcessToken RegOpenKeyExW LookupAccountSidW RegQueryValueExW GetTokenInformation CryptAcquireContextW CryptReleaseContext CryptGenRandom DeregisterEventSource RegisterEventSourceW

shell32

SHGetSpecialFolderPathW

shlwapi

PathFileExistsW PathAddBackslashW

psapi

GetProcessImageFileNameW EnumProcesses

userenv

CreateEnvironmentBlock

wldap32

ord143 ord46 ord211 ord301 ord200 ord30 ord79 ord35 ord33 ord60 ord27 ord26 ord22 ord41 ord50 ord32

ws2_32

WSAStartup WSACleanup WSAGetLastError __WSAFDIsSet select WSASetLastError send bind closesocket connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSAIoctl getaddrinfo freeaddrinfo recvfrom sendto accept listen ioctlsocket gethostname recv

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wtsapi32

WTSQueryUserToken

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

501KB

Virtual Size

501KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

168KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-01_29532a57b186f102a0660495502258f6_coinminer_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

kernel32

user32

advapi32

shell32

shlwapi

psapi

userenv

wldap32

ws2_32

version

wtsapi32

generic