2026-08-01_9450067393b0889960f58eee9203bdb0_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_9450067393b0889960f58eee9203bdb0_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil
Size 2.6MB
Sample260802-ajabmszgnf
SHA256 14d1f46b7308d4c5d25314546317ad13aceaacd988c7be34a2ae7f25a7512d80
MD5 9450067393b0889960f58eee9203bdb0
SHA1 1380b47886ddf3a900e20674e62d90e1febbcf12
SHA512 c5e37dfd06c3ab9034f0b990f491f5873c8b428309f576efbe50d5e0d8f4ddad7f81328a0b7e2c92769e7f700cbdbafa2855bfa785991cb17fff124518583ee4
SSDEEP 49152:OLc/Qwv2HRMhQ95KIa2qP3k0g6zwLSwfxejAM5:ec/QC2iRINkk0gSw
TLSH
T1FBD5AD1EFB468DB2E9CF017552A69B7B4C39AD2053248CC3D7F13D6999301D2663B38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_9450067393b0889960f58eee9203bdb0_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

File Explorer

2026-08-01_9450067393b0889960f58eee9203bdb0_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

.exe 2.6MB

2026-08-01_9450067393b0889960f58eee9203bdb0_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

IMPHASH 02ed1dcbf19e33ac2ed408d464b3cd98
SHA256 14d1f46b7308d4c5d25314546317ad13aceaacd988c7be34a2ae7f25a7512d80
MD5 9450067393b0889960f58eee9203bdb0
SHA1 1380b47886ddf3a900e20674e62d90e1febbcf12
SHA512 c5e37dfd06c3ab9034f0b990f491f5873c8b428309f576efbe50d5e0d8f4ddad7f81328a0b7e2c92769e7f700cbdbafa2855bfa785991cb17fff124518583ee4
SSDEEP 49152:OLc/Qwv2HRMhQ95KIa2qP3k0g6zwLSwfxejAM5:ec/QC2iRINkk0gSw
TLSH
T1FBD5AD1EFB468DB2E9CF017552A69B7B4C39AD2053248CC3D7F13D6999301D2663B38A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1577116

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TerminateProcess WaitForSingleObject LocalAlloc OpenProcess CreateToolhelp32Snapshot Process32NextW GlobalAlloc Process32FirstW GlobalFree LocalFree CreateProcessW GetExitCodeProcess VirtualFree VirtualAlloc GetCurrentThreadId Sleep ReadProcessMemory GetModuleHandleW lstrcmpiW GetTickCount GetSystemInfo VirtualProtect SetLastError LoadLibraryA GetNativeSystemInfo IsBadReadPtr UnmapViewOfFile FlushViewOfFile MapViewOfFile EnterCriticalSection LeaveCriticalSection InitializeCriticalSection CreateEventW SetEvent CreateThread SizeofResource InterlockedDecrement LoadResource FindResourceW InterlockedIncrement LoadLibraryExW GetEnvironmentVariableW RemoveDirectoryW CreateDirectoryW GetCurrentProcessId GetDriveTypeW GetFileSize MoveFileExW DeleteFileW FileTimeToSystemTime GetFileAttributesExW GetFileAttributesW GetTempPathW WriteFile ReadFile lstrcpyW FindClose GetLongPathNameW FindNextFileW FindFirstFileW WideCharToMultiByte GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException HeapReAlloc MultiByteToWideChar HeapSize InitializeCriticalSectionAndSpinCount HeapFree GetModuleFileNameW GetPrivateProfileIntW lstrlenW WritePrivateProfileStringW GetPrivateProfileStringW GetSystemDirectoryW GetVolumeInformationW ReleaseMutex CreateMutexW FreeLibrary GetProcAddress LoadLibraryW CloseHandle SetEndOfFile WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle GetCurrentDirectoryW GetTimeZoneInformation FlushFileBuffers EnumSystemLocalesW CopyFileW WTSGetActiveConsoleSessionId GetLastError GetVersionExW CreateFileW DeviceIoControl OutputDebugStringA GetCurrentProcess OpenFileMappingW SetPriorityClass GetUserDefaultLCID IsValidLocale FindFirstFileExW GetFullPathNameW GetConsoleCP GetACP SetConsoleCtrlHandler ExitProcess SetFilePointerEx ExitThread RtlUnwind FreeLibraryAndExitThread GetThreadTimes SystemTimeToTzSpecificLocalTime WinExec OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter ResetEvent SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber WaitForSingleObjectEx GetCurrentThread QueryPerformanceCounter EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo FormatMessageA SleepEx WaitForMultipleObjects GetFileType GetStdHandle PeekNamedPipe ExpandEnvironmentStringsA VerSetConditionMask GetModuleHandleA GetSystemDirectoryA VerifyVersionInfoA GetModuleHandleExW SwitchToFiber DeleteFiber

user32

CharNextW MessageBoxW GetUserObjectInformationW GetProcessWindowStation wsprintfW LoadStringW

advapi32

RegCloseKey GetFileSecurityW SetFileSecurityW GetSecurityDescriptorDacl GetSecurityDescriptorControl AddAccessAllowedAce GetAce RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegDeleteValueW SetTokenInformation CreateProcessAsUserW SetSecurityDescriptorDacl OpenProcessToken InitializeSecurityDescriptor DuplicateTokenEx LookupAccountSidW GetTokenInformation RevertToSelf RegEnumKeyW ImpersonateLoggedOnUser RegOpenKeyW LookupAccountNameW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW CryptAcquireContextW CryptReleaseContext CryptGenRandom DeregisterEventSource RegisterEventSourceW ReportEventW RegCreateKeyW RegSetValueW EqualSid GetLengthSid InitializeAcl GetAclInformation AddAce

shell32

SHGetSpecialFolderPathW ShellExecuteExW SHGetSpecialFolderPathA SHFileOperationW SHGetFolderPathW

ole32

CoUninitialize CoCreateInstance CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoInitialize

oleaut32

VarUI4FromStr

shlwapi

PathAddBackslashW PathFileExistsW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wldap32

ord33 ord143 ord46 ord211 ord60 ord50 ord41 ord22 ord26 ord27 ord32 ord35 ord79 ord30 ord200 ord301

ws2_32

WSAStartup WSACleanup WSAGetLastError __WSAFDIsSet select WSASetLastError recv send bind closesocket connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSAIoctl getaddrinfo freeaddrinfo recvfrom sendto accept listen ioctlsocket gethostname

wtsapi32

WTSQueryUserToken

wininet

InternetSetOptionW InternetCloseHandle InternetQueryOptionW InternetOpenUrlW InternetReadFile HttpQueryInfoW InternetOpenW

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

540KB

Virtual Size

539KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

704B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

285KB

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=22, id=241, version=40116,

count=198, id=243, version=40116,

count=30, id=242, version=40116,

count=2, id=261, version=23013,

count=6, id=199, version=41118,

count=26, id=259, version=24123,

count=14, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=28, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=648, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=123, id=261, version=24123,

count=39, id=260, version=24123,

count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=412, id=1, productName=Unmarked objects,

count=55, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,