2026-08-09_f9da78bbd4770e63969e42c246d52c70_coinminer_elex_floxif_helldown_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_f9da78bbd4770e63969e42c246d52c70_coinminer_elex_floxif_helldown_luca-stealer_mespinoza_njrat_remcos
Size 5.3MB
Sample260809-fbfrcazhmf
SHA256 b8ae4526b608b83571ec35484da90ea23526785ca3de29155eb1b17663a540af
MD5 f9da78bbd4770e63969e42c246d52c70
SHA1 46ae0196a887d622b7d80660d2688081c4981c0c
SHA512 ec6a29736cbfd9d88a80a4ce4a67aa1da52d0dcf0cf92e95b135742ca65f7d29731f67ee6cb30953f24a982be586714ca3f2764049df28976cfe4f604a44743e
SSDEEP 98304:jRNVQM+ljUIH8+4H0GM1up6++bsqNiP/ichQy:lp+CId4UfY71
TLSH
T12C46C01179D58436D33317325D2EA62F92FABDB04F31C58F63A82B2E2B719825625733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_f9da78bbd4770e63969e42c246d52c70_coinminer_elex_floxif_helldown_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-08-09_f9da78bbd4770e63969e42c246d52c70_coinminer_elex_floxif_helldown_luca-stealer_mespinoza_njrat_remcos

.exe 5.3MB

2026-08-09_f9da78bbd4770e63969e42c246d52c70_coinminer_elex_floxif_helldown_luca-stealer_mespinoza_njrat_remcos

IMPHASH 450bb1fbb4effde3b036914d2b595d0f
SHA256 b8ae4526b608b83571ec35484da90ea23526785ca3de29155eb1b17663a540af
MD5 f9da78bbd4770e63969e42c246d52c70
SHA1 46ae0196a887d622b7d80660d2688081c4981c0c
SHA512 ec6a29736cbfd9d88a80a4ce4a67aa1da52d0dcf0cf92e95b135742ca65f7d29731f67ee6cb30953f24a982be586714ca3f2764049df28976cfe4f604a44743e
SSDEEP 98304:jRNVQM+ljUIH8+4H0GM1up6++bsqNiP/ichQy:lp+CId4UfY71
TLSH
T12C46C01179D58436D33317325D2EA62F92FABDB04F31C58F63A82B2E2B719825625733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

80:68:c7:dc:33:a1:86:95:78:09:1c:8c:15:a9:0e:1c:60:1d:ff:56:74:3c:89:91:53:f9:cb:8e:96:71:4e:fb

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Cybertron Software Co.\, Ltd.,O=Cybertron Software Co.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Chains

Feb 28, 2026

CN=Cybertron Software Co.\, Ltd.,O=Cybertron Software Co.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=Cybertron Software Co.\, Ltd.,O=Cybertron Software Co.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=Cybertron Software Co.\, Ltd.,O=Cybertron Software Co.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

77:c6:f3:4b:67:fa:c1:ff:08:76:39:28

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 23, 2025 - Jun 23, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1527872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualFree LoadLibraryExW GetPrivateProfileSectionA GetPrivateProfileSectionNamesA WritePrivateProfileStructW LocalFileTimeToFileTime GetCurrentProcessId SetErrorMode FlushViewOfFile CreateMutexW CreateFileMappingW FindFirstFileW InterlockedDecrement GetModuleFileNameW VirtualAllocEx VirtualFreeEx ReadProcessMemory CreateIoCompletionPort GetQueuedCompletionStatus ResumeThread CreateProcessW CreateJobObjectW AssignProcessToJobObject SetInformationJobObject CreateRemoteThread GetDiskFreeSpaceW GetDiskFreeSpaceExW HeapAlloc HeapFree GetProcessHeap lstrcatW GetTempFileNameW OpenMutexW GetCurrentThreadId VirtualProtect WaitForMultipleObjects GetSystemTime InterlockedPopEntrySList FlushFileBuffers MultiByteToWideChar GetDriveTypeW GetExitCodeProcess GetFileAttributesW MoveFileExW OutputDebugStringW VirtualAlloc MoveFileW SetFileTime WriteConsoleW GetFileTime GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetCurrentThread FreeLibraryAndExitThread ExitThread ReadConsoleW GetConsoleMode GetConsoleCP SetStdHandle GetFileType lstrcpynW SetEnvironmentVariableA GetACP GetStdHandle GetModuleHandleExW ExitProcess InterlockedFlushSList InterlockedPushEntrySList RtlUnwind RaiseException ReplaceFileA MoveFileA SetFilePointerEx RemoveDirectoryA GetFileAttributesExA FindNextFileA FindFirstFileA CreateDirectoryA InitializeCriticalSection AreFileApisANSI HeapCreate InterlockedCompareExchange LockFile GetFullPathNameA UnlockFileEx HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW LoadLibraryA GetVersionExA HeapReAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx GetFileSizeEx SetFileAttributesW FormatMessageW SystemTimeToFileTime FreeEnvironmentStringsW OutputDebugStringA GetComputerNameW GetFullPathNameW ExpandEnvironmentStringsW GetEnvironmentVariableW GetLongPathNameW QueryPerformanceFrequency QueryPerformanceCounter RemoveDirectoryW QueryDosDeviceW LoadLibraryW GetLogicalDriveStringsW DuplicateHandle TerminateThread FreeLibrary GlobalFree GlobalAlloc GlobalUnlock GlobalLock GetDateFormatW GetTimeFormatW GetLocaleInfoW FileTimeToSystemTime FileTimeToLocalFileTime LocalFree LocalAlloc GetSystemInfo GetProcAddress FindFirstFileExW SetFilePointer SetEndOfFile DeleteFileW ReadFile GetFileSize WideCharToMultiByte DeleteFileA CreateFileA WriteFile SetLastError GetVolumeInformationW FindNextFileW lstrcmpW FindClose FormatMessageA UnmapViewOfFile SetVolumeLabelW GetTempPathW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx LCMapStringW UnregisterWaitEx QueryDepthSList ReleaseSemaphore GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority CompareStringW GetTickCount GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc GetCPInfo DecodePointer EncodePointer GetStringTypeW GetNumberFormatW FindResourceW SizeofResource LoadResource LockResource GetModuleHandleA GetLogicalDrives DeleteCriticalSection TryEnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetModuleHandleW OpenFileMappingW MapViewOfFile CreateFileW DeviceIoControl TerminateProcess OpenProcess GetVersionExW CreateDirectoryW CreateEventW lstrlenW GetLocalTime CloseHandle Sleep WaitForSingleObject ResetEvent SetEvent GetLastError CreateThread SetPriorityClass SetThreadPriority GetCurrentProcess FlushInstructionCache LoadLibraryExA CreateTimerQueue SignalObjectAndWait SwitchToThread

user32

DefWindowProcW RegisterClassExW CreateWindowExW IsIconic SetTimer KillTimer RegisterWindowMessageW EnableMenuItem SetMenuDefaultItem SetActiveWindow PtInRect TrackMouseEvent SetCapture GetClipboardData CloseClipboard OpenClipboard SetCursor GetSystemMetrics SystemParametersInfoW ReleaseDC GetDC LoadCursorW GetWindowThreadProcessId ExitWindowsEx EmptyClipboard EnumDisplaySettingsW EnumDisplayDevicesW DestroyMenu GetKeyState SetForegroundWindow GetWindowRect GetCursorPos GetWindowLongW SetWindowLongW ReleaseCapture ClientToScreen UnregisterClassW UpdateLayeredWindow GetMenuStringW FindWindowW DestroyIcon LoadStringW wsprintfW DestroyWindow mouse_event ShowCursor SetCursorPos GetActiveWindow ShowWindow FindWindowExW SendMessageTimeoutW GetPropW GetDesktopWindow GetSystemMenu CreatePopupMenu AppendMenuW TrackPopupMenu BeginPaint EndPaint SetClipboardData LoadIconW SetPropW DispatchMessageW TranslateMessage GetClassNameW EnumWindows EnumChildWindows GetParent IsWindowVisible IsWindow SendMessageW PeekMessageW MoveWindow IsWindowEnabled EnableWindow EndDialog IsZoomed SetWindowPlacement GetWindowPlacement UnregisterHotKey RegisterHotKey SetFocus GetWindow GetIconInfo SetWindowPos PostQuitMessage GetMessageW MessageBoxW PostMessageW

gdi32

CreateCompatibleDC GetObjectW DeleteObject EnumFontFamiliesW SelectObject CreateDIBSection DeleteDC

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

AllocateAndInitializeSid CryptReleaseContext CryptAcquireContextA DuplicateTokenEx CreateProcessAsUserW EqualSid SetTokenInformation CredEnumerateW CredDeleteW CredFree RegCloseKey RegCreateKeyW RegDeleteValueW RegEnumValueW RegQueryValueExW RegSetValueExW RegEnumKeyW RegOpenKeyExW RegQueryInfoKeyW RegOpenKeyW RegCreateKeyExW RegEnumKeyExW OpenEventLogW CloseEventLog ClearEventLogW GetUserNameW GetTokenInformation RegSetKeySecurity RegGetKeySecurity SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAce InitializeAcl GetLengthSid FreeSid CryptGenRandom GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority ConvertStringSidToSidW RegUnLoadKeyW RegLoadKeyW LookupPrivilegeValueW LookupAccountNameW AdjustTokenPrivileges OpenProcessToken RegDeleteKeyW

shell32

ShellExecuteW ShellExecuteExW SHEmptyRecycleBinW SHBrowseForFolderW SHFileOperationW SHGetDesktopFolder SHGetPathFromIDListW DragQueryFileW SHGetFolderPathW SHGetSpecialFolderPathW Shell_NotifyIconW SHAddToRecentDocs ExtractIconExW SHGetFileInfoW

ole32

StgIsStorageFile StgOpenStorageEx CoSetProxyBlanket CoInitialize OleRegGetUserType CLSIDFromString OleUninitialize OleInitialize PropVariantClear CoTaskMemFree CreateStreamOnHGlobal CoCreateInstance CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

VariantClear VariantInit VariantTimeToSystemTime SysFreeString SysAllocString

gdiplus

GdipAlloc GdipFree GdipCreatePath GdipDeleteBrush GdipCreatePathGradientFromPath GdipDeletePath GdipCloneBrush GdipResetPath GdiplusStartup GdipSetPenDashStyle GdipDeletePen GdipCreatePen1 GdipSetTextRenderingHint GdipMeasureString GdipDeleteGraphics GdipCreateFromHDC GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipClosePathFigure GdipAddPathPolygonI GdipGetFontHeightGivenDPI GdipSetPenDashArray GdipCreateTexture GdipCreateSolidFill GdipCreateLineBrushI GdipDrawString GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFont GdipDeleteFont GdipCreateRegion GdipGetImageHeight GdipDrawImageI GdipBitmapSetResolution GdipCreateBitmapFromScan0 GdipGetImageVerticalResolution GdipGetImageHorizontalResolution GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipAddPathRectangleI GdipAddPathLineI GdipAddPathArcI GdipCreateLineBrush GdipDrawImageRectRectI GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipSetImageAttributesGamma GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipGetDpiX GdipGetDpiY GdipDrawLine GdipDrawRectangle GdipGraphicsClear GdipFillRectangle GdipFillRectangleI GdipFillPath GdipDrawImage GdipDrawImageRect GdipDrawImagePointRectI GdipDrawImageRectRect GdipSetClipRectI GdipSetClipPath GdipSetClipRegion GdipGetClip GdipGetRegionBounds GdipGetRegionScansCount GdipGetRegionScansI GdipMeasureCharacterRanges GdipCloneStringFormat GdipSetStringFormatTabStops GdipSetStringFormatMeasurableCharacterRanges GdipSetPenColor GdipGetImagePixelFormat GdipCreateBitmapFromHBITMAP GdipBitmapLockBits GdipBitmapUnlockBits GdipSetPathGradientFocusScales GdipSetPathGradientPresetBlend GdipGetImageWidth GdipDeleteRegion GdipAddPathPieI

sfc

SfcIsFileProtected

ntdll

NtTerminateProcess NtWriteVirtualMemory

esent

JetMove JetRetrieveColumn JetTerm JetDelete JetCloseTable JetCloseDatabase JetEndSession JetInit2

wininet

InternetOpenUrlW InternetReadFileExA InternetReadFileExW InternetSetStatusCallbackW HttpQueryInfoW InternetCloseHandle InternetGetConnectedState DeleteUrlCacheEntryW FindFirstUrlCacheEntryExW FindNextUrlCacheEntryExW FindCloseUrlCache InternetOpenW InternetCheckConnectionW

crypt32

CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptQueryObject CryptMsgClose CryptDecodeObject CryptMsgGetParam

netapi32

NetUserEnum NetApiBufferFree

shlwapi

SHDeleteValueW SHDeleteKeyW PathGetDriveNumberW PathCanonicalizeW PathIsNetworkPathW PathFindExtensionW PathIsRelativeW SHStrDupW PathMatchSpecA PathStripPathW PathMatchSpecW PathFileExistsW PathIsDirectoryW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

comctl32

InitCommonControlsEx

psapi

EnumProcesses GetModuleFileNameExW GetProcessImageFileNameW EnumProcessModules

winmm

timeGetTime

generic

count=23, id=241, version=40116,

count=180, id=243, version=40116,

count=34, id=242, version=40116,

count=146, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=261, version=23013,

count=30, id=265, version=24215,

count=3, id=199, version=41118,

count=25, id=259, version=24123,

count=127, id=261, version=24123,

count=38, id=260, version=24123,

count=2, id=263, version=26715,

count=5, id=260, version=26715,

count=3, id=262, version=26715,

count=45, id=257, version=26715,

count=627, id=1, productName=Unmarked objects,

count=416, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,