earthworm | 2026-07-22_72d402557470965b810626874f2f8a8a_coinminer_elex

General

Target
2026-07-22_72d402557470965b810626874f2f8a8a_coinminer_elex
Size 80KB
Sample260723-b64dnsfa72
SHA256 e270594194c2b42e2d756d1369f6b9623b69df63e0cab91242ab6c59550324c7
MD5 72d402557470965b810626874f2f8a8a
SHA1 fc4f4773dfce668198a47cc0cdd4b4b6a454d09b
SHA512 bec5250f35964375b3f12748bc0404ccc322b2c0de7c0f9dc243d91c50b362c8ff501735863156b47995a3d37c9dfa3433552f61654dcbc0c79c62456fa7fb1d
SSDEEP 384:b7UJznnp6xTJijJIQ9g/ISenlN64BdQCNmiUTYXqRbBmDr4XRDWhRFk4IJ+gxScR:kzpWT4uQ9gslcwIgEWB1IyFq
TLSH
T1C2834B07F107A1B6C26683B1D1DFCA7FC7627961C4261E1EFB4E8D28BB236425D291B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: Earthworm
Earthworm is an open-source network tunnel tool targeting Windows and Linux, written in C++.
hacktool earthworm

Detects Earthworm payload 1 IoCs

resource	yara_rule
sample	family_earthworm

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_72d402557470965b810626874f2f8a8a_coinminer_elex

SHA256 e270594194c2b42e2d756d1369f6b9623b69df63e0cab91242ab6c59550324c7
MD5 72d402557470965b810626874f2f8a8a
SHA1 fc4f4773dfce668198a47cc0cdd4b4b6a454d09b
SHA512 bec5250f35964375b3f12748bc0404ccc322b2c0de7c0f9dc243d91c50b362c8ff501735863156b47995a3d37c9dfa3433552f61654dcbc0c79c62456fa7fb1d
SSDEEP 384:b7UJznnp6xTJijJIQ9g/ISenlN64BdQCNmiUTYXqRbBmDr4XRDWhRFk4IJ+gxScR:kzpWT4uQ9gslcwIgEWB1IyFq
TLSH
T1C2834B07F107A1B6C26683B1D1DFCA7FC7627961C4261E1EFB4E8D28BB236425D291B4
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Earthworm payload
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths