General
- Target 2026-07-09_e6ceb9cd4dce9f1e6dc4a7468da94a28_coinminer_elex_glassworm_magniber_maze_remcos_stealc_zxxz
- Size 4.9MB
- Sample260709-l5bmdagt2l
- SHA256 b852f0f03cc486b80672f6d686d500038fa78529f6999da129f1c39704934dae
Malware Config
Targets
-
- Target 2026-07-09_e6ceb9cd4dce9f1e6dc4a7468da94a28_coinminer_elex_glassworm_magniber_maze_remcos_stealc_zxxz
- Size 4.9MB
- SHA256 b852f0f03cc486b80672f6d686d500038fa78529f6999da129f1c39704934dae
Score9/10-
Detects JavaScript files used for persistence and executable or script execution
-
UPX dump on OEP (original entry point)
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Discovery
Peripheral Device Discovery
2Query Registry
5Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
1