2026-07-09_80f1ce95c6cf7427b314084385fdf1bb_coinminer_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

General

Target
2026-07-09_80f1ce95c6cf7427b314084385fdf1bb_coinminer_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil
Size 5.0MB
Sample260709-eby29ads4v
SHA256 12300bb68245f26d5621eeed92421363e27a848877b5fdd6970e8f8509c13c76
MD5 80f1ce95c6cf7427b314084385fdf1bb
SHA1 c9638b7c726044f5fbabab2391828a5ad837ca23
SHA512 8e1c741075fbe5b418f4da2046e8f7ab14688b27c85d87fb62b5eddd18a6823988f373599a78c6bfe3a8c631643f7e618980f9f3fbcb019e7736440c0ffc3a6e
SSDEEP 98304:QWnarh9ERdbLXLKHMarE9lSMyxKsd3OsBh1MJ9gfKdFN:VarhST+HMafd3AJ9YIFN
TLSH
T19336BF12FA808072E5B3413882BAAB7B997DB9201734C5C7A3E42D794D716D17B3E35B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_80f1ce95c6cf7427b314084385fdf1bb_coinminer_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

File Explorer

2026-07-09_80f1ce95c6cf7427b314084385fdf1bb_coinminer_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

.exe 5.0MB

2026-07-09_80f1ce95c6cf7427b314084385fdf1bb_coinminer_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

SHA256 12300bb68245f26d5621eeed92421363e27a848877b5fdd6970e8f8509c13c76
MD5 80f1ce95c6cf7427b314084385fdf1bb
SHA1 c9638b7c726044f5fbabab2391828a5ad837ca23
SHA512 8e1c741075fbe5b418f4da2046e8f7ab14688b27c85d87fb62b5eddd18a6823988f373599a78c6bfe3a8c631643f7e618980f9f3fbcb019e7736440c0ffc3a6e
SSDEEP 98304:QWnarh9ERdbLXLKHMarE9lSMyxKsd3OsBh1MJ9gfKdFN:VarhST+HMafd3AJ9YIFN
TLSH
T19336BF12FA808072E5B3413882BAAB7B997DB9201734C5C7A3E42D794D716D17B3E35B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

777910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

693KB

Virtual Size

693KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

111KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

132KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=23, id=241, version=40116,

count=200, id=243, version=40116,

count=29, id=242, version=40116,

count=525, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=40, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=261, version=23013,

count=13, id=199, version=41118,

count=26, id=259, version=24123,

count=111, id=261, version=24123,

count=21, id=260, version=24123,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=584, id=1, productName=Unmarked objects,

count=216, id=264, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_80f1ce95c6cf7427b314084385fdf1bb_coinminer_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

generic