2026-07-24_a64ee97d1233020b54affa9b27a4967e_coinminer_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil

General

Target
2026-07-24_a64ee97d1233020b54affa9b27a4967e_coinminer_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil
Size 6.8MB
Sample260724-ttv6msgp5y
SHA256 52c4c5cf259678e4d582c112c03288fd34edef9d68d3f7f2a748a5ef26e207d8
MD5 a64ee97d1233020b54affa9b27a4967e
SHA1 d7077a17e9b8853388b8e1a152a762eb0b7c850d
SHA512 04367336e0df3a99ed53d921da5c52c575b5f4b0dd1b7d3c2354c2148f10c039d67699d0d49051f47354f283bdc8c06aeb3ccae40ee6f42fd22bf5cf8a61b23b
SSDEEP 196608:Eo9pwI0xAEF4UFhlUM8P8wceYdObywORMs0WwD:FyIvEeUFhlUMFFjObybMse
TLSH
T19C66F112BE80C432E5A201729A7D7F694AFDFA311729C5C3ABD9099D4D309D2B739327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-24_a64ee97d1233020b54affa9b27a4967e_coinminer_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil

File Explorer

2026-07-24_a64ee97d1233020b54affa9b27a4967e_coinminer_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil

.exe 6.8MB

2026-07-24_a64ee97d1233020b54affa9b27a4967e_coinminer_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil

SHA256 52c4c5cf259678e4d582c112c03288fd34edef9d68d3f7f2a748a5ef26e207d8
MD5 a64ee97d1233020b54affa9b27a4967e
SHA1 d7077a17e9b8853388b8e1a152a762eb0b7c850d
SHA512 04367336e0df3a99ed53d921da5c52c575b5f4b0dd1b7d3c2354c2148f10c039d67699d0d49051f47354f283bdc8c06aeb3ccae40ee6f42fd22bf5cf8a61b23b
SSDEEP 196608:Eo9pwI0xAEF4UFhlUM8P8wceYdObywORMs0WwD:FyIvEeUFhlUMFFjObybMse
TLSH
T19C66F112BE80C432E5A201729A7D7F694AFDFA311729C5C3ABD9099D4D309D2B739327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

960875

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

739KB

Virtual Size

738KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

45KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

580B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

925KB

Virtual Size

925KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

134KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=32, id=241, version=40116,

count=213, id=243, version=40116,

count=35, id=242, version=40116,

count=3, id=261, productName=VS2019 v16.11.5 build 30136, version=30136,

count=42, id=261, version=24245,

count=17, id=265, version=24210,

count=570, id=260, version=24245,

count=102, id=260, version=24247,

count=3, id=261, version=23013,

count=10, id=199, version=41118,

count=29, id=259, version=24123,

count=38, id=260, version=24123,

count=75, id=261, version=24123,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=738, id=1, productName=Unmarked objects,

count=3, id=261, productName=VS2019 v16.7.5 build 29112, version=29112,

count=22, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=208, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=2, id=151,

count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-24_a64ee97d1233020b54affa9b27a4967e_coinminer_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil

generic