2026-08-09_2b560fa3c9ea5233a25d2b6580112fe7_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_2b560fa3c9ea5233a25d2b6580112fe7_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos
Size 3.2MB
Sample260809-xdds7sw1fs
SHA256 323c854f9228c80fe2987996d261da9fa760710fb350eba2e924b5b3287967f7
MD5 2b560fa3c9ea5233a25d2b6580112fe7
SHA1 48a82fb1e6c92751b759f6279b2ededc74447da4
SHA512 5344630c75bb351c5876d143f4afaaef8a6ed8ebb5cb8eaed0d0caca8f97244dd9dc1ebcbbbdc73587e27a1aa5378de8bd60a5fd7eb6c7b1f134c6b39174c8af
SSDEEP 49152:EK5pY+uVYtjxjUHCZN9aH2AKP8F+/NEGzfuB+dWTcoPPxg8J896JH6OdwcXI5J1c:Eg2z2hEF+/NEmfuB+cRg8qIJd
TLSH
T1F7F5AE11B781C432E9A301F14929ABFE4479FE201B2581C3B7BD7A5E4B316C2DE3A756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_2b560fa3c9ea5233a25d2b6580112fe7_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-08-09_2b560fa3c9ea5233a25d2b6580112fe7_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

.exe 3.2MB

2026-08-09_2b560fa3c9ea5233a25d2b6580112fe7_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

IMPHASH 05ff7cfb9e67518417d45a0be7e73762
SHA256 323c854f9228c80fe2987996d261da9fa760710fb350eba2e924b5b3287967f7
MD5 2b560fa3c9ea5233a25d2b6580112fe7
SHA1 48a82fb1e6c92751b759f6279b2ededc74447da4
SHA512 5344630c75bb351c5876d143f4afaaef8a6ed8ebb5cb8eaed0d0caca8f97244dd9dc1ebcbbbdc73587e27a1aa5378de8bd60a5fd7eb6c7b1f134c6b39174c8af
SSDEEP 49152:EK5pY+uVYtjxjUHCZN9aH2AKP8F+/NEGzfuB+dWTcoPPxg8J896JH6OdwcXI5J1c:Eg2z2hEF+/NEmfuB+cRg8qIJd
TLSH
T1F7F5AE11B781C432E9A301F14929ABFE4479FE201B2581C3B7BD7A5E4B316C2DE3A756
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

703944

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\baidu\netdisk\pc-yunbrowser\output\AutoUpdate\output\pdb\Autoupdate.pdb

kernel32

FileTimeToSystemTime FlushFileBuffers GetFileInformationByHandle GetLogicalDrives GetVolumeInformationW DuplicateHandle GetExitCodeThread CreateFileMappingW MapViewOfFile UnmapViewOfFile RemoveDirectoryW GetTempFileNameW SetFilePointerEx SetFileTime Sleep TlsAlloc TlsFree TlsSetValue TlsGetValue GetPrivateProfileStringW GetModuleHandleW GetTickCount FreeLibrary GetProcAddress LoadLibraryW WriteFile CreateDirectoryW ReadFile GetFileSize WaitForSingleObject DeleteFileW SetLastError RaiseException LeaveCriticalSection EnterCriticalSection GetCurrentThreadId GetModuleFileNameW ReadDirectoryChangesW SetConsoleCtrlHandler SetEndOfFile EncodePointer OutputDebugStringW AllocConsole GetStdHandle GetConsoleScreenBufferInfo FreeConsole SetConsoleTextAttribute WriteConsoleW InitializeCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount CloseHandle Module32NextW CreateFileW GetLastError MultiByteToWideChar GetVolumeInformationA FindResourceExW FindResourceW LoadResource LockResource SizeofResource WideCharToMultiByte GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize GetPrivateProfileIntW GetCurrentProcessId CreateMutexW ReleaseMutex VerSetConditionMask VerifyVersionInfoW SetThreadPriority TerminateThread WaitForMultipleObjects Process32NextW Process32FirstW CreateToolhelp32Snapshot LoadLibraryA SetFilePointer GetFileAttributesW GetTempPathW GetCurrentProcess FindClose FindNextFileW FindFirstFileW OpenEventW ResetEvent ExitProcess GetCommandLineW OpenProcess DecodePointer LoadLibraryExW lstrcmpiW GetPrivateProfileSectionW GetSystemTime SystemTimeToFileTime WritePrivateProfileStringW MoveFileW SetEvent CreateEventW GetVersionExW CopyFileW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindNextFileA DeviceIoControl Module32FirstW FindFirstFileExA GetOEMCP IsValidCodePage GetTimeZoneInformation SetStdHandle GetFullPathNameW GetCurrentDirectoryW GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetModuleFileNameA GetACP SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW FreeLibraryAndExitThread ExitThread CreateThread GetFileAttributesExW RtlUnwind GetModuleHandleA GlobalUnlock GlobalLock GlobalAlloc lstrlenW FreeResource MulDiv HeapCreate MoveFileExW FormatMessageW LocalFree ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetEnvironmentVariableW ConvertFiberToThread DeleteFiber GetFileType GetModuleHandleExW QueryPerformanceCounter HeapDestroy GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetStringTypeW IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA GetSystemTimeAsFileTime

user32

RegisterClassExW UnregisterClassW DestroyWindow IsWindow KillTimer SetTimer CharLowerBuffW PostThreadMessageW MessageBoxW PostMessageW PostQuitMessage GetMessageW PeekMessageW SetForegroundWindow SetWindowPos AttachThreadInput GetWindowThreadProcessId GetProcessWindowStation GetUserObjectInformationW GetDlgItem GetParent TrackMouseEvent AnimateWindow UpdateLayeredWindow PrintWindow SetLayeredWindowAttributes MoveWindow IsWindowVisible IsIconic IsWindowEnabled SetFocus GetActiveWindow SetCapture ReleaseCapture EnableWindow GetSystemMetrics EndMenu UpdateWindow SetActiveWindow GetDC ReleaseDC CharNextW EndPaint InvalidateRect GetClientRect GetWindowRect GetCursorPos CreateCaret GetCaretBlinkTime SetCaretPos ClientToScreen ScreenToClient MapWindowPoints CopyRect InflateRect IntersectRect IsRectEmpty GetDesktopWindow EnumChildWindows GetWindow MonitorFromWindow GetMonitorInfoW GetKeyState SetCursor PtInRect EqualRect LoadBitmapW LoadImageW DrawTextW OffsetRect DestroyIcon DrawIconEx FillRect SetRect MapVirtualKeyA DefWindowProcW GetSysColor FindWindowExW UnionRect SetRectEmpty OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard MessageBeep CreatePopupMenu DestroyMenu AppendMenuW TrackPopupMenu GetMenuItemInfoW GetForegroundWindow ShowWindow SendMessageW LoadIconW SetWindowTextW CallWindowProcW GetWindowLongW SetWindowLongW CreateWindowExW LoadCursorW GetClassInfoExW DispatchMessageW BeginPaint TranslateMessage IsZoomed EnableMenuItem

gdi32

DeleteDC CreateBitmap GetTextMetricsW BitBlt CombineRgn CreateCompatibleBitmap CreateCompatibleDC CreateRectRgnIndirect GetCurrentObject GetObjectType GetRgnBox SelectClipRgn SelectObject SetBkColor SetBkMode StretchBlt SetTextColor GetObjectW ExtTextOutW SetViewportOrgEx CreatePen CreateRectRgn ExcludeClipRect GetClipRgn RectInRegion Rectangle RestoreDC SaveDC ExtSelectClipRgn OffsetViewportOrgEx AddFontMemResourceEx RemoveFontMemResourceEx GetTextExtentPointW GetTextExtentPoint32W GetDeviceCaps CreateFontIndirectW GetObjectA CreateSolidBrush GetStockObject DeleteObject GetTextColor GetViewportOrgEx LineTo RoundRect CreateDIBSection ExtCreatePen MoveToEx TextOutW GetClipBox CreateDIBitmap

advapi32

CryptExportKey CreateProcessAsUserW AdjustTokenPrivileges LookupPrivilegeValueW CheckTokenMembership CreateWellKnownSid GetTokenInformation DuplicateTokenEx OpenProcessToken RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegCloseKey RegQueryValueExA RegOpenKeyExA DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptEnumProvidersW CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW RegQueryValueExW

shell32

SHGetFolderPathW CommandLineToArgvW ord680 ShellExecuteExW ShellExecuteW SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal OleLockRunning CLSIDFromProgID CoCreateInstance CoTaskMemFree CoCreateGuid StringFromCLSID CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CoInitializeEx CLSIDFromString CoLoadLibrary StringFromGUID2 StgCreateStorageEx StgOpenStorageEx CreateBindCtx

oleaut32

SysFreeString SysAllocString VariantClear GetErrorInfo SysStringLen VarBstrCmp SysAllocStringByteLen SysStringByteLen VariantInit LoadRegTypeLi LoadTypeLi VarUI4FromStr VariantCopy SafeArrayCreate SafeArrayGetUBound SysAllocStringLen SafeArrayGetLBound SafeArrayLock SafeArrayUnlock VarCmp

shlwapi

StrToIntExA StrToIntW

iphlpapi

GetAdaptersAddresses

wininet

HttpEndRequestA InternetOpenA InternetSetOptionA InternetConnectA HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestExA HttpQueryInfoW HttpEndRequestW HttpSendRequestW HttpAddRequestHeadersW HttpOpenRequestW InternetSetStatusCallbackW InternetSetOptionW InternetWriteFile HttpQueryInfoA InternetQueryDataAvailable InternetReadFile InternetCloseHandle InternetConnectW InternetReadFileExA InternetQueryOptionA

setupapi

SetupIterateCabinetW SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces

bcrypt

BCryptGenRandom

imm32

ImmReleaseContext ImmGetContext

dwmapi

DwmGetWindowAttribute

gdiplus

GdipCreateTexture2I GdipDeleteBrush GdipCloneBrush GdipGetImageHeight GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipLoadImageFromStream GdipCreateFromHDC GdipDeleteGraphics GdipFillRectangleI GdipDrawImageRectRectI GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipDisposeImage GdipCloneImage GdipLoadImageFromFileICM GdipLoadImageFromStreamICM GdipSetImageAttributesWrapMode GdipLoadImageFromFile GdipGetImageWidth

msimg32

GradientFill AlphaBlend

ws2_32

closesocket WSAGetLastError WSACleanup recv send WSASetLastError

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

787KB

Virtual Size

786KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

49KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

270KB

Virtual Size

270KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

194KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_2b560fa3c9ea5233a25d2b6580112fe7_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

iphlpapi

wininet

setupapi

bcrypt

imm32

dwmapi

gdiplus

msimg32

ws2_32

crypt32

generic