2026-08-09_a8738372662d6085a4cc1e5e48af1c4a_coinminer_elex_helldown_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_a8738372662d6085a4cc1e5e48af1c4a_coinminer_elex_helldown_luca-stealer_mespinoza_njrat_remcos
Size 5.6MB
Sample260809-tpsvqabc76
SHA256 ff26c9bf85989210c9cb8cb20ba05dde881bbaec3dc9d92af65fa6df030b62f9
MD5 a8738372662d6085a4cc1e5e48af1c4a
SHA1 11ae22f0500dae095971947548701a490c559edc
SHA512 e9fa98ccbb449eb3db2ed08aaceaff48bc19ebfaa76bf43b3570e335c5eb23c00d7b344531859c5007e76951d842b13519bbf853ca8c89b67281faee222aff0c
SSDEEP 98304:QRNVgM+ljUIc8+4H0GM1up62nsqNiP/ichQ:U5+CIU4UaY7
TLSH
T1AD46C01179D58436D33317325D2EA62F92BABDB04F31C58F63AC2B2E2B719825625733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_a8738372662d6085a4cc1e5e48af1c4a_coinminer_elex_helldown_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-08-09_a8738372662d6085a4cc1e5e48af1c4a_coinminer_elex_helldown_luca-stealer_mespinoza_njrat_remcos

.exe 5.6MB

2026-08-09_a8738372662d6085a4cc1e5e48af1c4a_coinminer_elex_helldown_luca-stealer_mespinoza_njrat_remcos

IMPHASH 450bb1fbb4effde3b036914d2b595d0f
SHA256 ff26c9bf85989210c9cb8cb20ba05dde881bbaec3dc9d92af65fa6df030b62f9
MD5 a8738372662d6085a4cc1e5e48af1c4a
SHA1 11ae22f0500dae095971947548701a490c559edc
SHA512 e9fa98ccbb449eb3db2ed08aaceaff48bc19ebfaa76bf43b3570e335c5eb23c00d7b344531859c5007e76951d842b13519bbf853ca8c89b67281faee222aff0c
SSDEEP 98304:QRNVgM+ljUIc8+4H0GM1up62nsqNiP/ichQ:U5+CIU4UaY7
TLSH
T1AD46C01179D58436D33317325D2EA62F92BABDB04F31C58F63AC2B2E2B719825625733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1527872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualFree LoadLibraryExW GetPrivateProfileSectionA GetPrivateProfileSectionNamesA WritePrivateProfileStructW LocalFileTimeToFileTime GetCurrentProcessId SetErrorMode FlushViewOfFile CreateMutexW CreateFileMappingW FindFirstFileW InterlockedDecrement GetModuleFileNameW VirtualAllocEx VirtualFreeEx ReadProcessMemory CreateIoCompletionPort GetQueuedCompletionStatus ResumeThread CreateProcessW CreateJobObjectW AssignProcessToJobObject SetInformationJobObject CreateRemoteThread GetDiskFreeSpaceW GetDiskFreeSpaceExW HeapAlloc HeapFree GetProcessHeap lstrcatW GetTempFileNameW OpenMutexW GetCurrentThreadId VirtualProtect WaitForMultipleObjects GetSystemTime InterlockedPopEntrySList FlushFileBuffers MultiByteToWideChar GetDriveTypeW GetExitCodeProcess GetFileAttributesW MoveFileExW OutputDebugStringW VirtualAlloc MoveFileW SetFileTime WriteConsoleW GetFileTime GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetCurrentThread FreeLibraryAndExitThread ExitThread ReadConsoleW GetConsoleMode GetConsoleCP SetStdHandle GetFileType lstrcpynW SetEnvironmentVariableA GetACP GetStdHandle GetModuleHandleExW ExitProcess InterlockedFlushSList InterlockedPushEntrySList RtlUnwind RaiseException ReplaceFileA MoveFileA SetFilePointerEx RemoveDirectoryA GetFileAttributesExA FindNextFileA FindFirstFileA CreateDirectoryA InitializeCriticalSection AreFileApisANSI HeapCreate InterlockedCompareExchange LockFile GetFullPathNameA UnlockFileEx HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW LoadLibraryA GetVersionExA HeapReAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx GetFileSizeEx SetFileAttributesW FormatMessageW SystemTimeToFileTime FreeEnvironmentStringsW OutputDebugStringA GetComputerNameW GetFullPathNameW ExpandEnvironmentStringsW GetEnvironmentVariableW GetLongPathNameW QueryPerformanceFrequency QueryPerformanceCounter RemoveDirectoryW QueryDosDeviceW LoadLibraryW GetLogicalDriveStringsW DuplicateHandle TerminateThread FreeLibrary GlobalFree GlobalAlloc GlobalUnlock GlobalLock GetDateFormatW GetTimeFormatW GetLocaleInfoW FileTimeToSystemTime FileTimeToLocalFileTime LocalFree LocalAlloc GetSystemInfo GetProcAddress FindFirstFileExW SetFilePointer SetEndOfFile DeleteFileW ReadFile GetFileSize WideCharToMultiByte DeleteFileA CreateFileA WriteFile SetLastError GetVolumeInformationW FindNextFileW lstrcmpW FindClose FormatMessageA UnmapViewOfFile SetVolumeLabelW GetTempPathW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx LCMapStringW UnregisterWaitEx QueryDepthSList ReleaseSemaphore GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority CompareStringW GetTickCount GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc GetCPInfo DecodePointer EncodePointer GetStringTypeW GetNumberFormatW FindResourceW SizeofResource LoadResource LockResource GetModuleHandleA GetLogicalDrives DeleteCriticalSection TryEnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetModuleHandleW OpenFileMappingW MapViewOfFile CreateFileW DeviceIoControl TerminateProcess OpenProcess GetVersionExW CreateDirectoryW CreateEventW lstrlenW GetLocalTime CloseHandle Sleep WaitForSingleObject ResetEvent SetEvent GetLastError CreateThread SetPriorityClass SetThreadPriority GetCurrentProcess FlushInstructionCache LoadLibraryExA CreateTimerQueue SignalObjectAndWait SwitchToThread

user32

DefWindowProcW RegisterClassExW CreateWindowExW IsIconic SetTimer KillTimer RegisterWindowMessageW EnableMenuItem SetMenuDefaultItem SetActiveWindow PtInRect TrackMouseEvent SetCapture GetClipboardData CloseClipboard OpenClipboard SetCursor GetSystemMetrics SystemParametersInfoW ReleaseDC GetDC LoadCursorW GetWindowThreadProcessId ExitWindowsEx EmptyClipboard EnumDisplaySettingsW EnumDisplayDevicesW DestroyMenu GetKeyState SetForegroundWindow GetWindowRect GetCursorPos GetWindowLongW SetWindowLongW ReleaseCapture ClientToScreen UnregisterClassW UpdateLayeredWindow GetMenuStringW FindWindowW DestroyIcon LoadStringW wsprintfW DestroyWindow mouse_event ShowCursor SetCursorPos GetActiveWindow ShowWindow FindWindowExW SendMessageTimeoutW GetPropW GetDesktopWindow GetSystemMenu CreatePopupMenu AppendMenuW TrackPopupMenu BeginPaint EndPaint SetClipboardData LoadIconW SetPropW DispatchMessageW TranslateMessage GetClassNameW EnumWindows EnumChildWindows GetParent IsWindowVisible IsWindow SendMessageW PeekMessageW MoveWindow IsWindowEnabled EnableWindow EndDialog IsZoomed SetWindowPlacement GetWindowPlacement UnregisterHotKey RegisterHotKey SetFocus GetWindow GetIconInfo SetWindowPos PostQuitMessage GetMessageW MessageBoxW PostMessageW

gdi32

CreateCompatibleDC GetObjectW DeleteObject EnumFontFamiliesW SelectObject CreateDIBSection DeleteDC

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

AllocateAndInitializeSid CryptReleaseContext CryptAcquireContextA DuplicateTokenEx CreateProcessAsUserW EqualSid SetTokenInformation CredEnumerateW CredDeleteW CredFree RegCloseKey RegCreateKeyW RegDeleteValueW RegEnumValueW RegQueryValueExW RegSetValueExW RegEnumKeyW RegOpenKeyExW RegQueryInfoKeyW RegOpenKeyW RegCreateKeyExW RegEnumKeyExW OpenEventLogW CloseEventLog ClearEventLogW GetUserNameW GetTokenInformation RegSetKeySecurity RegGetKeySecurity SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAce InitializeAcl GetLengthSid FreeSid CryptGenRandom GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority ConvertStringSidToSidW RegUnLoadKeyW RegLoadKeyW LookupPrivilegeValueW LookupAccountNameW AdjustTokenPrivileges OpenProcessToken RegDeleteKeyW

shell32

ShellExecuteW ShellExecuteExW SHEmptyRecycleBinW SHBrowseForFolderW SHFileOperationW SHGetDesktopFolder SHGetPathFromIDListW DragQueryFileW SHGetFolderPathW SHGetSpecialFolderPathW Shell_NotifyIconW SHAddToRecentDocs ExtractIconExW SHGetFileInfoW

ole32

StgIsStorageFile StgOpenStorageEx CoSetProxyBlanket CoInitialize OleRegGetUserType CLSIDFromString OleUninitialize OleInitialize PropVariantClear CoTaskMemFree CreateStreamOnHGlobal CoCreateInstance CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

VariantClear VariantInit VariantTimeToSystemTime SysFreeString SysAllocString

gdiplus

GdipAlloc GdipFree GdipCreatePath GdipDeleteBrush GdipCreatePathGradientFromPath GdipDeletePath GdipCloneBrush GdipResetPath GdiplusStartup GdipSetPenDashStyle GdipDeletePen GdipCreatePen1 GdipSetTextRenderingHint GdipMeasureString GdipDeleteGraphics GdipCreateFromHDC GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipClosePathFigure GdipAddPathPolygonI GdipGetFontHeightGivenDPI GdipSetPenDashArray GdipCreateTexture GdipCreateSolidFill GdipCreateLineBrushI GdipDrawString GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFont GdipDeleteFont GdipCreateRegion GdipGetImageHeight GdipDrawImageI GdipBitmapSetResolution GdipCreateBitmapFromScan0 GdipGetImageVerticalResolution GdipGetImageHorizontalResolution GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipAddPathRectangleI GdipAddPathLineI GdipAddPathArcI GdipCreateLineBrush GdipDrawImageRectRectI GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipSetImageAttributesGamma GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipGetDpiX GdipGetDpiY GdipDrawLine GdipDrawRectangle GdipGraphicsClear GdipFillRectangle GdipFillRectangleI GdipFillPath GdipDrawImage GdipDrawImageRect GdipDrawImagePointRectI GdipDrawImageRectRect GdipSetClipRectI GdipSetClipPath GdipSetClipRegion GdipGetClip GdipGetRegionBounds GdipGetRegionScansCount GdipGetRegionScansI GdipMeasureCharacterRanges GdipCloneStringFormat GdipSetStringFormatTabStops GdipSetStringFormatMeasurableCharacterRanges GdipSetPenColor GdipGetImagePixelFormat GdipCreateBitmapFromHBITMAP GdipBitmapLockBits GdipBitmapUnlockBits GdipSetPathGradientFocusScales GdipSetPathGradientPresetBlend GdipGetImageWidth GdipDeleteRegion GdipAddPathPieI

sfc

SfcIsFileProtected

ntdll

NtTerminateProcess NtWriteVirtualMemory

esent

JetMove JetRetrieveColumn JetTerm JetDelete JetCloseTable JetCloseDatabase JetEndSession JetInit2

wininet

InternetOpenUrlW InternetReadFileExA InternetReadFileExW InternetSetStatusCallbackW HttpQueryInfoW InternetCloseHandle InternetGetConnectedState DeleteUrlCacheEntryW FindFirstUrlCacheEntryExW FindNextUrlCacheEntryExW FindCloseUrlCache InternetOpenW InternetCheckConnectionW

crypt32

CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptQueryObject CryptMsgClose CryptDecodeObject CryptMsgGetParam

netapi32

NetUserEnum NetApiBufferFree

shlwapi

SHDeleteValueW SHDeleteKeyW PathGetDriveNumberW PathCanonicalizeW PathIsNetworkPathW PathFindExtensionW PathIsRelativeW SHStrDupW PathMatchSpecA PathStripPathW PathMatchSpecW PathFileExistsW PathIsDirectoryW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

comctl32

InitCommonControlsEx

psapi

EnumProcesses GetModuleFileNameExW GetProcessImageFileNameW EnumProcessModules

winmm

timeGetTime

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

838KB

Virtual Size

840KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

452KB

Virtual Size

452KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=23, id=241, version=40116,

count=180, id=243, version=40116,

count=34, id=242, version=40116,

count=146, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=261, version=23013,

count=30, id=265, version=24215,

count=3, id=199, version=41118,

count=25, id=259, version=24123,

count=127, id=261, version=24123,

count=38, id=260, version=24123,

count=2, id=263, version=26715,

count=5, id=260, version=26715,

count=3, id=262, version=26715,

count=45, id=257, version=26715,

count=627, id=1, productName=Unmarked objects,

count=416, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,