2026-08-11_b51d340067da38faae62ae80744ad736_coinminer_elex_glassworm_helldown

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_b51d340067da38faae62ae80744ad736_coinminer_elex_glassworm_helldown
Size 3.3MB
Sample260811-cz861stdrc
SHA256 4e77b0fae182852089d53ef5fd708fe1bf9b1c77b276c5b46770cf44c4927d51
MD5 b51d340067da38faae62ae80744ad736
SHA1 d4842bda6fc78384d1d04bcd93c0d17a6b906b22
SHA512 a547650e7d29fbbd5a804299bd1fc993435d7a1fa6c77d249119db81f33211dbfad1d9dd37aa823cf5cd9058d32570bbf8bc795ebc0c3c24f990f3dccda32243
SSDEEP 98304:hRj+KN0k48L11Uz9FepMKP4RoNtETVQs+bvS:hwKN0kT3Uz9FeiKHw2/bvS
TLSH
T1A5F59E05EA8B44F1ED170A70414BFB7F4B319A50C820CEF2EA94FD4AFD336A2552975A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_b51d340067da38faae62ae80744ad736_coinminer_elex_glassworm_helldown

File Explorer

2026-08-11_b51d340067da38faae62ae80744ad736_coinminer_elex_glassworm_helldown

.exe 3.3MB

2026-08-11_b51d340067da38faae62ae80744ad736_coinminer_elex_glassworm_helldown

IMPHASH a28c7f7bb9c7d7f1d5b49627f11f921c
SHA256 4e77b0fae182852089d53ef5fd708fe1bf9b1c77b276c5b46770cf44c4927d51
MD5 b51d340067da38faae62ae80744ad736
SHA1 d4842bda6fc78384d1d04bcd93c0d17a6b906b22
SHA512 a547650e7d29fbbd5a804299bd1fc993435d7a1fa6c77d249119db81f33211dbfad1d9dd37aa823cf5cd9058d32570bbf8bc795ebc0c3c24f990f3dccda32243
SSDEEP 98304:hRj+KN0k48L11Uz9FepMKP4RoNtETVQs+bvS:hwKN0kT3Uz9FeiKHw2/bvS
TLSH
T1A5F59E05EA8B44F1ED170A70414BFB7F4B319A50C820CEF2EA94FD4AFD336A2552975A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CryptAcquireContextA CryptCreateHash CryptDecrypt CryptDeriveKey CryptDestroyHash CryptEncrypt CryptGetHashParam CryptHashData CryptReleaseContext DeregisterEventSource LookupPrivilegeValueA OpenProcessToken RegisterEventSourceA ReportEventA

comdlg32

GetOpenFileNameA GetSaveFileNameA

crypt32

CryptProtectData CryptUnprotectData

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDCA DeleteDC DeleteObject GetBitmapBits GetDeviceCaps GetObjectA GetStockObject SelectObject SetBitmapBits

kernel32

CloseHandle ConnectNamedPipe CreateNamedPipeA CreateProcessA CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DisconnectNamedPipe EnterCriticalSection ExitProcess FindClose FindFirstFileA FindFirstFileExA FindNextFileA FlushFileBuffers FormatMessageA FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileType GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetSystemInfo GetTempPathA GetTickCount GetVersion GetVersionExA GlobalMemoryStatus HeapAlloc HeapFree InitializeCriticalSection InterlockedDecrement InterlockedExchange InterlockedIncrement IsBadReadPtr IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LocalFree Module32First Module32Next MultiByteToWideChar OpenProcess OutputDebugStringA Process32First Process32Next QueryPerformanceCounter ReadFile ReadProcessMemory ReleaseSemaphore SetFilePointer SetLastError SetUnhandledExceptionFilter Sleep TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile WriteProcessMemory

msvcrt

_chdir _chmod _chsize _close _fdopen _fstat _getcwd _hypot _mkdir _nextafter _open _read _setmode _spawnl _stat _strdup _stricmp _strnicmp _unlink _utime _write __getmainargs __lc_codepage __mb_cur_max __p__environ __p__fmode __set_app_type _assert _cexit _errno _exit _filbuf _filelengthi64 _flsbuf _ftime _getch _iob _isctype _onexit _pctype _setjmp _setmode _stat _stricmp _strnicmp _vsnprintf _wfopen _winmajor abort acos asin atan atan2 atexit atoi bsearch calloc ceil clock cos cosh exit exp fclose fflush fgetc fgetpos fgets floor fmod fopen fprintf fputc fputs fread free frexp fseek fsetpos ftell fwrite getenv gmtime ldexp localeconv localtime log log10 longjmp malloc memchr memcmp memcpy memmove memset mktime modf perror pow printf putchar puts qsort raise rand realloc remove rewind setbuf signal sin sinh sprintf sqrt srand sscanf strcat strchr strcmp strcpy strerror strlen strncat strncmp strncpy strrchr strstr strtol strtoul system tan tanh time tolower toupper ungetc vfprintf vprintf wcslen wcsstr

user32

BeginPaint CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA EndPaint EnumWindows FindWindowA GetClassNameA GetClientRect GetDC GetDesktopWindow GetForegroundWindow GetMessageA GetProcessWindowStation GetUserObjectInformationW GetWindowLongA GetWindowThreadProcessId InvalidateRect LoadCursorA LoadIconA MessageBoxA PeekMessageA PostMessageA PostQuitMessage RegisterClassA ReleaseDC ShowWindow TranslateMessage UpdateWindow

winmm

waveInAddBuffer waveInClose waveInGetNumDevs waveInGetPosition waveInOpen waveInPrepareHeader waveInReset waveInStart waveInUnprepareHeader waveOutClose waveOutGetNumDevs waveOutOpen waveOutPrepareHeader waveOutReset waveOutUnprepareHeader waveOutWrite

ws2_32

WSAGetLastError WSASetLastError WSAStartup accept bind closesocket connect gethostbyname htons inet_addr inet_ntoa listen ntohs recv recvfrom select send sendto setsockopt shutdown socket

arcfour_LTX__is_block_algorithm arcfour_LTX__mcrypt_algorithm_version arcfour_LTX__mcrypt_decrypt arcfour_LTX__mcrypt_encrypt arcfour_LTX__mcrypt_get_algo_iv_size arcfour_LTX__mcrypt_get_algorithms_name arcfour_LTX__mcrypt_get_block_size arcfour_LTX__mcrypt_get_key_size arcfour_LTX__mcrypt_get_size arcfour_LTX__mcrypt_get_supported_key_sizes arcfour_LTX__mcrypt_self_test arcfour_LTX__mcrypt_set_key blowfish_LTX__is_block_algorithm blowfish_LTX__mcrypt_algorithm_version blowfish_LTX__mcrypt_decrypt blowfish_LTX__mcrypt_encrypt blowfish_LTX__mcrypt_get_algorithms_name blowfish_LTX__mcrypt_get_block_size blowfish_LTX__mcrypt_get_key_size blowfish_LTX__mcrypt_get_size blowfish_LTX__mcrypt_get_supported_key_sizes blowfish_LTX__mcrypt_self_test blowfish_LTX__mcrypt_set_key blowfish_compat_LTX__is_block_algorithm blowfish_compat_LTX__mcrypt_algorithm_version blowfish_compat_LTX__mcrypt_decrypt blowfish_compat_LTX__mcrypt_encrypt blowfish_compat_LTX__mcrypt_get_algorithms_name blowfish_compat_LTX__mcrypt_get_block_size blowfish_compat_LTX__mcrypt_get_key_size blowfish_compat_LTX__mcrypt_get_size blowfish_compat_LTX__mcrypt_get_supported_key_sizes blowfish_compat_LTX__mcrypt_self_test blowfish_compat_LTX__mcrypt_set_key cast_128_LTX__is_block_algorithm cast_128_LTX__mcrypt_algorithm_version cast_128_LTX__mcrypt_decrypt cast_128_LTX__mcrypt_encrypt cast_128_LTX__mcrypt_get_algorithms_name cast_128_LTX__mcrypt_get_block_size cast_128_LTX__mcrypt_get_key_size cast_128_LTX__mcrypt_get_size cast_128_LTX__mcrypt_get_supported_key_sizes cast_128_LTX__mcrypt_self_test cast_128_LTX__mcrypt_set_key cast_256_LTX__is_block_algorithm cast_256_LTX__mcrypt_algorithm_version cast_256_LTX__mcrypt_decrypt cast_256_LTX__mcrypt_encrypt cast_256_LTX__mcrypt_get_algorithms_name cast_256_LTX__mcrypt_get_block_size cast_256_LTX__mcrypt_get_key_size cast_256_LTX__mcrypt_get_size cast_256_LTX__mcrypt_get_supported_key_sizes cast_256_LTX__mcrypt_self_test cast_256_LTX__mcrypt_set_key des_LTX__is_block_algorithm des_LTX__mcrypt_algorithm_version des_LTX__mcrypt_decrypt des_LTX__mcrypt_encrypt des_LTX__mcrypt_get_algorithms_name des_LTX__mcrypt_get_block_size des_LTX__mcrypt_get_key_size des_LTX__mcrypt_get_size des_LTX__mcrypt_get_supported_key_sizes des_LTX__mcrypt_self_test des_LTX__mcrypt_set_key end_mcrypt enigma_LTX__is_block_algorithm enigma_LTX__mcrypt_algorithm_version enigma_LTX__mcrypt_decrypt enigma_LTX__mcrypt_encrypt enigma_LTX__mcrypt_get_algo_iv_size enigma_LTX__mcrypt_get_algorithms_name enigma_LTX__mcrypt_get_block_size enigma_LTX__mcrypt_get_key_size enigma_LTX__mcrypt_get_size enigma_LTX__mcrypt_get_supported_key_sizes enigma_LTX__mcrypt_self_test enigma_LTX__mcrypt_set_key gost_LTX__is_block_algorithm gost_LTX__mcrypt_algorithm_version gost_LTX__mcrypt_decrypt gost_LTX__mcrypt_encrypt gost_LTX__mcrypt_get_algorithms_name gost_LTX__mcrypt_get_block_size gost_LTX__mcrypt_get_key_size gost_LTX__mcrypt_get_size gost_LTX__mcrypt_get_supported_key_sizes gost_LTX__mcrypt_self_test gost_LTX__mcrypt_set_key init_mcrypt loki97_LTX__is_block_algorithm loki97_LTX__mcrypt_algorithm_version loki97_LTX__mcrypt_decrypt loki97_LTX__mcrypt_encrypt loki97_LTX__mcrypt_get_algorithms_name loki97_LTX__mcrypt_get_block_size loki97_LTX__mcrypt_get_key_size loki97_LTX__mcrypt_get_size loki97_LTX__mcrypt_get_supported_key_sizes loki97_LTX__mcrypt_self_test loki97_LTX__mcrypt_set_key mcrypt mcrypt_dlopen mcrypt_enc_get_algorithms_name mcrypt_enc_get_block_size mcrypt_enc_get_iv_size mcrypt_enc_get_key_size mcrypt_enc_get_modes_name mcrypt_enc_get_state mcrypt_enc_get_supported_key_sizes mcrypt_enc_is_block_algorithm mcrypt_enc_is_block_algorithm_mode mcrypt_enc_is_block_mode mcrypt_enc_mode_has_iv mcrypt_enc_self_test mcrypt_enc_set_state mcrypt_free mcrypt_generic mcrypt_generic_deinit mcrypt_generic_end mcrypt_generic_init mcrypt_get_algo_iv_size mcrypt_get_size mcrypt_mode_get_size mcrypt_module_algorithm_version mcrypt_module_close mcrypt_module_get_algo_block_size mcrypt_module_get_algo_key_size mcrypt_module_get_algo_supported_key_sizes mcrypt_module_is_block_algorithm mcrypt_module_is_block_algorithm_mode mcrypt_module_is_block_mode mcrypt_module_mode_version mcrypt_module_open mcrypt_module_self_test mcrypt_perror mcrypt_set_key mcrypt_strerror mdecrypt mdecrypt_generic rc2_LTX__is_block_algorithm rc2_LTX__mcrypt_algorithm_version rc2_LTX__mcrypt_decrypt rc2_LTX__mcrypt_encrypt rc2_LTX__mcrypt_get_algorithms_name rc2_LTX__mcrypt_get_block_size rc2_LTX__mcrypt_get_key_size rc2_LTX__mcrypt_get_size rc2_LTX__mcrypt_get_supported_key_sizes rc2_LTX__mcrypt_self_test rc2_LTX__mcrypt_set_key rijndael_128_LTX__is_block_algorithm rijndael_128_LTX__mcrypt_algorithm_version rijndael_128_LTX__mcrypt_decrypt rijndael_128_LTX__mcrypt_encrypt rijndael_128_LTX__mcrypt_get_algorithms_name rijndael_128_LTX__mcrypt_get_block_size rijndael_128_LTX__mcrypt_get_key_size rijndael_128_LTX__mcrypt_get_size rijndael_128_LTX__mcrypt_get_supported_key_sizes rijndael_128_LTX__mcrypt_self_test rijndael_128_LTX__mcrypt_set_key rijndael_192_LTX__is_block_algorithm rijndael_192_LTX__mcrypt_algorithm_version rijndael_192_LTX__mcrypt_decrypt rijndael_192_LTX__mcrypt_encrypt rijndael_192_LTX__mcrypt_get_algorithms_name rijndael_192_LTX__mcrypt_get_block_size rijndael_192_LTX__mcrypt_get_key_size rijndael_192_LTX__mcrypt_get_size rijndael_192_LTX__mcrypt_get_supported_key_sizes rijndael_192_LTX__mcrypt_self_test rijndael_192_LTX__mcrypt_set_key rijndael_256_LTX__is_block_algorithm rijndael_256_LTX__mcrypt_algorithm_version rijndael_256_LTX__mcrypt_decrypt rijndael_256_LTX__mcrypt_encrypt rijndael_256_LTX__mcrypt_get_algorithms_name rijndael_256_LTX__mcrypt_get_block_size rijndael_256_LTX__mcrypt_get_key_size rijndael_256_LTX__mcrypt_get_size rijndael_256_LTX__mcrypt_get_supported_key_sizes rijndael_256_LTX__mcrypt_self_test rijndael_256_LTX__mcrypt_set_key saferplus_LTX__is_block_algorithm saferplus_LTX__mcrypt_algorithm_version saferplus_LTX__mcrypt_decrypt saferplus_LTX__mcrypt_encrypt saferplus_LTX__mcrypt_get_algorithms_name saferplus_LTX__mcrypt_get_block_size saferplus_LTX__mcrypt_get_key_size saferplus_LTX__mcrypt_get_size saferplus_LTX__mcrypt_get_supported_key_sizes saferplus_LTX__mcrypt_self_test saferplus_LTX__mcrypt_set_key serpent_LTX__is_block_algorithm serpent_LTX__mcrypt_algorithm_version serpent_LTX__mcrypt_decrypt serpent_LTX__mcrypt_encrypt serpent_LTX__mcrypt_get_algorithms_name serpent_LTX__mcrypt_get_block_size serpent_LTX__mcrypt_get_key_size serpent_LTX__mcrypt_get_size serpent_LTX__mcrypt_get_supported_key_sizes serpent_LTX__mcrypt_self_test serpent_LTX__mcrypt_set_key tripledes_LTX__is_block_algorithm tripledes_LTX__mcrypt_algorithm_version tripledes_LTX__mcrypt_decrypt tripledes_LTX__mcrypt_encrypt tripledes_LTX__mcrypt_get_algorithms_name tripledes_LTX__mcrypt_get_block_size tripledes_LTX__mcrypt_get_key_size tripledes_LTX__mcrypt_get_size tripledes_LTX__mcrypt_get_supported_key_sizes tripledes_LTX__mcrypt_self_test tripledes_LTX__mcrypt_set_key twofish_LTX__is_block_algorithm twofish_LTX__mcrypt_algorithm_version twofish_LTX__mcrypt_decrypt twofish_LTX__mcrypt_encrypt twofish_LTX__mcrypt_get_algorithms_name twofish_LTX__mcrypt_get_block_size twofish_LTX__mcrypt_get_key_size twofish_LTX__mcrypt_get_size twofish_LTX__mcrypt_get_supported_key_sizes twofish_LTX__mcrypt_self_test twofish_LTX__mcrypt_set_key wake_LTX__is_block_algorithm wake_LTX__mcrypt_algorithm_version wake_LTX__mcrypt_decrypt wake_LTX__mcrypt_encrypt wake_LTX__mcrypt_get_algo_iv_size wake_LTX__mcrypt_get_algorithms_name wake_LTX__mcrypt_get_block_size wake_LTX__mcrypt_get_key_size wake_LTX__mcrypt_get_size wake_LTX__mcrypt_get_supported_key_sizes wake_LTX__mcrypt_self_test wake_LTX__mcrypt_set_key xtea_LTX__is_block_algorithm xtea_LTX__mcrypt_algorithm_version xtea_LTX__mcrypt_decrypt xtea_LTX__mcrypt_encrypt xtea_LTX__mcrypt_get_algorithms_name xtea_LTX__mcrypt_get_block_size xtea_LTX__mcrypt_get_key_size xtea_LTX__mcrypt_get_size xtea_LTX__mcrypt_get_supported_key_sizes xtea_LTX__mcrypt_self_test xtea_LTX__mcrypt_set_key

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

206KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

558KB

Virtual Size

558KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

6.9MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ