2026-07-14_2fd7653f68173c2c6aebe524ca1818b5_coinminer_elex_floxif_glassworm_graphican_hijackloader_remcos_revil_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_2fd7653f68173c2c6aebe524ca1818b5_coinminer_elex_floxif_glassworm_graphican_hijackloader_remcos_revil_stop
Size 1.5MB
Sample260714-vs8wsacs2s
SHA256 800bd742dcf37f339f3454d0615b118bb09b147bf465765f5fd0d32706b20332
MD5 2fd7653f68173c2c6aebe524ca1818b5
SHA1 ce4a57447727d94d7ab10f51877a389abb04b05a
SHA512 3372bb0a5a74ecb153d61f47f7ef4707d41b03246da3768320de4be7761bc1dac5dd035eca2fdcc88b5c3cc4b5620bd3de3ca7dea20aa396a8fa9403fa4b41bc
SSDEEP 24576:znWKZAJPi5+wMQy1+KpP7X9UObPU2wbFOdiTfpEBaLJkkLGDZ7rEH7x:yKePi5AZls2wZLr+ZE
TLSH
T16A659E12BA92C1B2E682037461A6E37E5D3A9D394325C1C7D7A139358D312D26B3F3DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-14_2fd7653f68173c2c6aebe524ca1818b5_coinminer_elex_floxif_glassworm_graphican_hijackloader_remcos_revil_stop

File Explorer

2026-07-14_2fd7653f68173c2c6aebe524ca1818b5_coinminer_elex_floxif_glassworm_graphican_hijackloader_remcos_revil_stop

.exe 1.5MB

2026-07-14_2fd7653f68173c2c6aebe524ca1818b5_coinminer_elex_floxif_glassworm_graphican_hijackloader_remcos_revil_stop

IMPHASH f3dcba3971dfa0300e0d5a5436750597
SHA256 800bd742dcf37f339f3454d0615b118bb09b147bf465765f5fd0d32706b20332
MD5 2fd7653f68173c2c6aebe524ca1818b5
SHA1 ce4a57447727d94d7ab10f51877a389abb04b05a
SHA512 3372bb0a5a74ecb153d61f47f7ef4707d41b03246da3768320de4be7761bc1dac5dd035eca2fdcc88b5c3cc4b5620bd3de3ca7dea20aa396a8fa9403fa4b41bc
SSDEEP 24576:znWKZAJPi5+wMQy1+KpP7X9UObPU2wbFOdiTfpEBaLJkkLGDZ7rEH7x:yKePi5AZls2wZLr+ZE
TLSH
T16A659E12BA92C1B2E682037461A6E37E5D3A9D394325C1C7D7A139358D312D26B3F3DE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

96:ac:09:4d:16:df:ce:3d:16:ca:ce:e0:4d:e7:06:a6:42:1a:09:4b:87:74:0d:08:fc:88:81:c4:20:58:8c:ba

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=215-87-21739,CN=iniLINE Co.\, Ltd.,O=iniLINE Co.\, Ltd.,L=Guro-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 22, 2023

SERIALNUMBER=215-87-21739,CN=iniLINE Co.\, Ltd.,O=iniLINE Co.\, Ltd.,L=Guro-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=215-87-21739,CN=iniLINE Co.\, Ltd.,O=iniLINE Co.\, Ltd.,L=Guro-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

a3:4e:ad:cf:3a:26:ef:8d:1b:23:08:37:06:8a:f7:d9:b3:4b:6d:4e

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=215-87-21739,CN=iniLINE Co.\, Ltd.,O=iniLINE Co.\, Ltd.,L=Guro-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 22, 2023

SERIALNUMBER=215-87-21739,CN=iniLINE Co.\, Ltd.,O=iniLINE Co.\, Ltd.,L=Guro-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=215-87-21739,CN=iniLINE Co.\, Ltd.,O=iniLINE Co.\, Ltd.,L=Guro-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=215-87-21739,CN=iniLINE Co.\, Ltd.,O=iniLINE Co.\, Ltd.,L=Guro-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

08:5e:a2:df:61:66:a5:4c:e4:28:7a:6c:80:ed:fc:7f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 23, 2021 - Jan 9, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

188403

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Build\CrossEXService\client\projects\windows\Release\CrossEXService.pdb

kernel32

ReadConsoleInputA SetConsoleMode FindFirstFileA lstrlenW GetModuleHandleW LocalFree FormatMessageW GlobalUnlock GlobalLock GlobalAlloc GlobalFree lstrcmpA FileTimeToSystemTime SystemTimeToFileTime GetModuleFileNameW GetCurrentProcessId LocalAlloc TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree InterlockedDecrement InterlockedIncrement CompareStringW lstrcmpW GlobalFlags FindClose GetCurrentThreadId GlobalAddAtomW LoadLibraryW SetFilePointer FlushFileBuffers SetEndOfFile GetModuleHandleA GetVersionExA LoadLibraryA GlobalDeleteAtom GlobalFindAtomW CompareStringA FileTimeToLocalFileTime HeapFree HeapAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread GetFileType HeapReAlloc GetSystemTimeAsFileTime GetCommandLineA GetStartupInfoA RtlUnwind RaiseException HeapSize GetModuleFileNameA SetConsoleCtrlHandler InitializeCriticalSectionAndSpinCount HeapCreate VirtualFree VirtualAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount SetStdHandle GetConsoleCP GetConsoleMode GetProcessHeap LCMapStringA LCMapStringW GetCurrentDirectoryA GetTimeZoneInformation FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetLocaleInfoA GetStringTypeA GetStringTypeW WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA GetDriveTypeA GetFullPathNameA GlobalMemoryStatus FlushConsoleInputBuffer GetSystemTime SetLastError GetStdHandle GetTickCount SetHandleInformation GetCurrentProcess TerminateProcess CreateProcessA GetExitCodeProcess Sleep UnregisterWaitEx RegisterWaitForSingleObject DisconnectNamedPipe GetOverlappedResult CreateNamedPipeW ConnectNamedPipe UnregisterWait DeleteCriticalSection CreateEventW EnterCriticalSection LeaveCriticalSection TerminateThread InitializeCriticalSection SetEvent WaitForSingleObject ExitProcess LoadLibraryExA LockResource GetProcAddress SizeofResource WideCharToMultiByte GetUserDefaultLangID LoadResource FreeLibrary FindResourceW CloseHandle ReleaseMutex SetNamedPipeHandleState GetLastError MultiByteToWideChar CreateFileW ReadFile WriteFile WaitNamedPipeW lstrlenA CreateMutexW

user32

RemovePropW GetPropW SetPropW GetClassLongW GetCapture WinHelpW RegisterWindowMessageW CheckMenuItem EnableMenuItem ModifyMenuW LoadBitmapW GetMenuCheckMarkDimensions SetMenuItemBitmaps DestroyMenu GetProcessWindowStation GetUserObjectInformationW MessageBoxA SetMenu SetForegroundWindow GetClientRect PostMessageW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx CallWindowProcW CopyRect GetMenu GetForegroundWindow SystemParametersInfoA IsIconic GetWindowPlacement GetMessagePos GrayStringW DrawTextExW DrawTextW TabbedTextOutW SetWindowsHookExW CallNextHookEx GetKeyState PeekMessageW ValidateRect SetWindowPos SetWindowLongW IsWindow GetDlgItem GetFocus ClientToScreen GetWindow GetDlgCtrlID GetWindowRect GetClassNameW PtInRect SetWindowTextW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush UnhookWindowsHookEx GetWindowThreadProcessId SendMessageW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetTopWindow DestroyWindow GetMessageTime GetMessageW PostQuitMessage LoadCursorW TranslateMessage RegisterClassExW LoadIconW LoadStringW MapWindowPoints ShowWindow CreateWindowExW UpdateWindow DefWindowProcW DispatchMessageW GetWindowTextW

advapi32

RegOpenKeyExA RegCloseKey ReportEventA RegQueryValueExA DeregisterEventSource RegisterEventSourceA

ole32

CoTaskMemAlloc CoTaskMemFree

ws2_32

sendto setsockopt closesocket recv ntohs htons __WSAFDIsSet bind socket getsockname gethostbyname send getsockopt listen accept shutdown getpeername WSASetLastError ioctlsocket connect inet_ntoa WSAStartup recvfrom ntohl htonl select WSAGetLastError

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

oleacc

LresultFromObject CreateStdAccessibleObject

gdi32

OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape SetViewportExtEx ExtTextOutW TextOutW RectVisible PtVisible DeleteObject SaveDC RestoreDC GetStockObject CreateBitmap DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx GetDeviceCaps SetBkColor SetTextColor SetMapMode GetClipBox

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

oleaut32

VariantClear VariantChangeType VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_2fd7653f68173c2c6aebe524ca1818b5_coinminer_elex_floxif_glassworm_graphican_hijackloader_remcos_revil_stop

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

ole32

ws2_32

version

oleacc

gdi32

winspool.drv

oleaut32

generic