2026-07-17_421f4f0d08ca7674fa8b849c4b2837a9_coinminer_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-17_421f4f0d08ca7674fa8b849c4b2837a9_coinminer_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil
Size 1.6MB
Sample260718-epwt2sa13t
SHA256 125e8c5516db124550dd333439099ae2992a9859e4db4d37a2a589e4f618b0c9
MD5 421f4f0d08ca7674fa8b849c4b2837a9
SHA1 d77ee5eca1ba471b7a9ca3e9ee6002bcee4804cf
SHA512 25e519576d255443a64763514ec2588a299aea3e48f7ce095e68cc9979e7fc5234de6edb8660cecab1486a5c2e41fa38a2098dc370d5eb47d5e12bd219331774
SSDEEP 49152:XiYNnmOlipOKjYhpvCdaPG9cackzCpFOs:S6nmkipOQO62Hk8
TLSH
T1C885CF12FA8186F2D89241355177777E4E3AAD25432A85C3C7907C298E322D16F3F7AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-17_421f4f0d08ca7674fa8b849c4b2837a9_coinminer_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

File Explorer

2026-07-17_421f4f0d08ca7674fa8b849c4b2837a9_coinminer_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

.exe 1.6MB

2026-07-17_421f4f0d08ca7674fa8b849c4b2837a9_coinminer_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

IMPHASH 5ff6accc0c39d40d7eaaf22137784c33
SHA256 125e8c5516db124550dd333439099ae2992a9859e4db4d37a2a589e4f618b0c9
MD5 421f4f0d08ca7674fa8b849c4b2837a9
SHA1 d77ee5eca1ba471b7a9ca3e9ee6002bcee4804cf
SHA512 25e519576d255443a64763514ec2588a299aea3e48f7ce095e68cc9979e7fc5234de6edb8660cecab1486a5c2e41fa38a2098dc370d5eb47d5e12bd219331774
SSDEEP 49152:XiYNnmOlipOKjYhpvCdaPG9cackzCpFOs:S6nmkipOQO62Hk8
TLSH
T1C885CF12FA8186F2D89241355177777E4E3AAD25432A85C3C7907C298E322D16F3F7AB
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a5:82:78:a0:88:81:d5:64:46:20:85:c2:71:9f:75:a2:5e:62:aa:95:96:db:d8:32:76:ca:ee:45:7b:9f:76:e1

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110-81-41568,CN=KOREA INFORMATION CERTIFICATE AUTHORITY INC.,O=KOREA INFORMATION CERTIFICATE AUTHORITY INC.,POSTALCODE=13487,STREET=242\, Pangyo-ro\, Bundang-gu,L=Seongnam-si\,,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

May 15, 2020

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

PE Signature issue

Digest

d8:fe:d6:fe:50:f0:72:96:57:d3:cd:5b:ea:5b:1a:1e:3d:7f:19:b9

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

May 15, 2020

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 27, 2011 - May 30, 2020

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - May 30, 2020

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 3, 2014 - Dec 2, 2029

Subject

Serial Number

ad:1f:8d:19:41:85:3a:87:c2:23:f8:a7:a4:05:d5:eb

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2018 - Dec 25, 2021

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

61:18:54:86:00:00:00:00:00:24

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 11, 2011 - Apr 11, 2021

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

762709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\khan\Central\Workspace\2020\001 SecuKit Clients\03 Worspaces\nxs\trunk\src\Release\kpmcnt.pdb

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

advapi32

DeregisterEventSource ReportEventA RegisterEventSourceA

kernel32

GetDriveTypeW OutputDebugStringA GetCurrentThreadId GetVersionExW GetCurrentDirectoryA GetSystemDirectoryA GetCPInfo GetACP MultiByteToWideChar WideCharToMultiByte LoadLibraryExA GetProcAddress FreeLibrary HeapFree InitializeCriticalSectionAndSpinCount CreateMutexW HeapSize Sleep GetLastError HeapReAlloc CloseHandle RaiseException HeapAlloc DecodePointer DeleteCriticalSection GetProcessHeap lstrcpyW WaitForSingleObject CreateEventW SetEvent LockResource LoadResource FindResourceW SetLastError SetPriorityClass GetCurrentProcess SetThreadPriority PeekNamedPipe OpenFileMappingW UnmapViewOfFile OutputDebugStringW CreateThread CreateFileMappingW MapViewOfFile OpenMutexW GetStdHandle GetFileType WriteFile GetModuleHandleA QueryPerformanceCounter GetCurrentProcessId GetTickCount LoadLibraryA GlobalMemoryStatus FlushConsoleInputBuffer GetSystemTime SystemTimeToFileTime LoadLibraryW CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle VirtualProtect VirtualFree VirtualAlloc GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SwitchToThread SignalObjectAndWait SetEndOfFile WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFullPathNameW OpenEventW IsValidCodePage FindNextFileW FindFirstFileExW GetCurrentDirectoryW FindClose CreateFileW SetStdHandle ReadConsoleW GetConsoleCP FlushFileBuffers CreateDirectoryW GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileAttributesExW SetFilePointerEx GetCurrentThread GetModuleFileNameW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection ResetEvent WaitForSingleObjectEx GetModuleHandleW IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead TryEnterCriticalSection EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW LoadLibraryExW InterlockedPushEntrySList InterlockedFlushSList RtlUnwind ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess SetConsoleCtrlHandler ReadFile GetConsoleMode ReadConsoleInputA SetConsoleMode

user32

UpdateWindow DialogBoxParamW PostQuitMessage GetClientRect SetForegroundWindow LoadCursorW LoadIconW CreateWindowExA MoveWindow ShowWindow GetSubMenu GetCursorPos BeginPaint EndPaint EnableWindow SendMessageA MessageBoxA GetUserObjectInformationW GetProcessWindowStation DefWindowProcW LoadMenuW PostMessageW DestroyWindow CreateWindowExW SendMessageW EndDialog RegisterClassExW LoadAcceleratorsW TrackPopupMenu LoadStringW

shell32

Shell_NotifyIconW

oleaut32

SysAllocString SysFreeString

ws2_32

ntohs socket send inet_addr WSAStartup listen inet_ntoa closesocket bind accept __WSAFDIsSet shutdown WSASetLastError recv htons setsockopt ioctlsocket select WSAGetLastError

Name

.text

Size

1008KB

Virtual Size

1008KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

342KB

Virtual Size

342KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

43KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

138KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-17_421f4f0d08ca7674fa8b849c4b2837a9_coinminer_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

PE Signature issue

PE Signature issue

version

advapi32

kernel32

user32

shell32

oleaut32

ws2_32

generic