2026-08-04_77a6486c16a2527986bed74a84f03e8f_coinminer_elex_floxif_glassworm_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_77a6486c16a2527986bed74a84f03e8f_coinminer_elex_floxif_glassworm_stop
Size 1.1MB
Sample260805-a3k79abb65
SHA256 163537c7f0d6b93e6b96f108969fe260bbbc586907898b161d5e0650bfcf56b5
MD5 77a6486c16a2527986bed74a84f03e8f
SHA1 23882bddf0baade165a0bb899fe2c25d319e7a6f
SHA512 b0fa9f90117d6bb2a4e9007227191526a59371145c9bdfcd2a08789fb47aaac39b2718461c5e824ec3c45760313cbb106fe860183ad5d8a674f39d36aefb318b
SSDEEP 24576:YcY9Z6AWZAXy+Ex+ADf7MSKZw0dkHpIk3hJErEH7i:Ytq1z+Ab43ZZyHpIkxs
TLSH
T13C459D42B74081B1EA4107702166F27A4E32BE3A67AAD5DBD7E13D358C316D25A3F38D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-04_77a6486c16a2527986bed74a84f03e8f_coinminer_elex_floxif_glassworm_stop

File Explorer

2026-08-04_77a6486c16a2527986bed74a84f03e8f_coinminer_elex_floxif_glassworm_stop

.exe 1.1MB

2026-08-04_77a6486c16a2527986bed74a84f03e8f_coinminer_elex_floxif_glassworm_stop

IMPHASH a5d089cb9b965fd45b20412c7d62c8e1
SHA256 163537c7f0d6b93e6b96f108969fe260bbbc586907898b161d5e0650bfcf56b5
MD5 77a6486c16a2527986bed74a84f03e8f
SHA1 23882bddf0baade165a0bb899fe2c25d319e7a6f
SHA512 b0fa9f90117d6bb2a4e9007227191526a59371145c9bdfcd2a08789fb47aaac39b2718461c5e824ec3c45760313cbb106fe860183ad5d8a674f39d36aefb318b
SSDEEP 24576:YcY9Z6AWZAXy+Ex+ADf7MSKZw0dkHpIk3hJErEH7i:Ytq1z+Ab43ZZyHpIkxs
TLSH
T13C459D42B74081B1EA4107702166F27A4E32BE3A67AAD5DBD7E13D358C316D25A3F38D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

bf:95:36:bc:cc:f3:c6:8b:71:93:0f:0c:79:0d:f6:27:33:a8:2e:a6

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=ESTsoft Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Chains

Jun 20, 2014

CN=ESTsoft Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=ESTsoft Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Serial Number

4b:cf:9c:8b:e1:7f:74:a1:72:ad:d3:db:88:6e:ed:76

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 28, 2013 - Dec 27, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

609820

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\study\ALCM_branch\bin\Release\DebugInfo\ALCMUpdate.pdb

kernel32

lstrlenA GetFileAttributesW FileTimeToLocalFileTime FileTimeToSystemTime FormatMessageA GetSystemDirectoryW MultiByteToWideChar GetModuleHandleW GetProcAddress ReadFile SetFilePointer GetFileSize CreateFileW GetLocalTime MoveFileExW GetTickCount WideCharToMultiByte GetModuleFileNameW ExpandEnvironmentStringsW FreeLibrary LoadLibraryW GetVersionExW SetLastError CreateDirectoryW WriteFile GetWindowsDirectoryW SetEnvironmentVariableA CompareStringW CompareStringA GetProcessHeap SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW GetCurrentDirectoryA CreateFileA PeekNamedPipe GetFileInformationByHandle GetFullPathNameA FlushFileBuffers GetConsoleCP GetModuleHandleA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetTempPathW lstrlenW DeleteFileW FindClose GetLastError CreateMutexW CloseHandle ReleaseMutex SetStdHandle GetStringTypeA InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GetVersion GetFileType GetStdHandle QueryPerformanceCounter GetCurrentProcessId GlobalMemoryStatus LoadLibraryA GetVersionExA FlushConsoleInputBuffer ExitProcess HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetCPInfo GetTimeZoneInformation GetSystemTimeAsFileTime GetStartupInfoW RaiseException RtlUnwind LCMapStringA LCMapStringW GetStringTypeW HeapReAlloc GetDriveTypeA FindFirstFileA SetConsoleCtrlHandler ReadConsoleInputA SetConsoleMode GetConsoleMode TlsGetValue TlsAlloc TlsSetValue TlsFree HeapSize GetModuleFileNameA InitializeCriticalSectionAndSpinCount GetACP GetOEMCP IsValidCodePage HeapCreate VirtualFree VirtualAlloc SetHandleCount GetStartupInfoA

user32

GetUserObjectInformationW GetDesktopWindow GetProcessWindowStation wsprintfW MessageBoxA

advapi32

RegEnumKeyExW ReportEventA RegCloseKey RegOpenKeyExW RegQueryValueExW RegSetValueExW RegCreateKeyExW RegDeleteKeyW RegQueryInfoKeyW DeregisterEventSource RegisterEventSourceA

ole32

CoTaskMemFree

wininet

DeleteUrlCacheEntryW

urlmon

URLDownloadToFileW

wsock32

shutdown setsockopt recv htons __WSAFDIsSet closesocket gethostbyname WSAGetLastError select ioctlsocket send getsockopt accept WSASetLastError WSAStartup inet_ntoa connect socket

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_77a6486c16a2527986bed74a84f03e8f_coinminer_elex_floxif_glassworm_stop

PE Signature issue

kernel32

user32

advapi32

ole32

wininet

urlmon

wsock32

version

generic