2026-08-12_fd8c4baea4084a3ca0e6eefdbb578fa4_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_fd8c4baea4084a3ca0e6eefdbb578fa4_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil
Size 3.5MB
Sample260812-3pgbcsfq41
SHA256 84614ea1525b940ba6556f29a277f6be288b771e4913791d489368cdc80536db
MD5 fd8c4baea4084a3ca0e6eefdbb578fa4
SHA1 514a537be51afb5f9137828a256a39ff6d6c9017
SHA512 edac3dd23a5f66c790ec5a1d548f48b319f3dd9be438669ef69abbd3ed4519650a2187b148dbbeb1ed23c8e546f9092ae8b747991d4fbfe72e13c6bf07ede6dc
SSDEEP 98304:NU4lh3WWO1t6DFK7m9cZwsUp0g7KvrXYMpLwLXz67K318m2IU5fqh:RuG85wsOKvrXYMpLwLXz67K318m2I+i
TLSH
T1BF06CF13FB8284B2E5A30135556B673B4D3AEE205734C5D3A7E53E688E301D16A3F39A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-12_fd8c4baea4084a3ca0e6eefdbb578fa4_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil

.exe 3.5MB

2026-08-12_fd8c4baea4084a3ca0e6eefdbb578fa4_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil

IMPHASH 066aabf2ecea36e11d3f624056e72dfc
SHA256 84614ea1525b940ba6556f29a277f6be288b771e4913791d489368cdc80536db
MD5 fd8c4baea4084a3ca0e6eefdbb578fa4
SHA1 514a537be51afb5f9137828a256a39ff6d6c9017
SHA512 edac3dd23a5f66c790ec5a1d548f48b319f3dd9be438669ef69abbd3ed4519650a2187b148dbbeb1ed23c8e546f9092ae8b747991d4fbfe72e13c6bf07ede6dc
SSDEEP 98304:NU4lh3WWO1t6DFK7m9cZwsUp0g7KvrXYMpLwLXz67K318m2IU5fqh:RuG85wsOKvrXYMpLwLXz67K318m2I+i
TLSH
T1BF06CF13FB8284B2E5A30135556B673B4D3AEE205734C5D3A7E53E688E301D16A3F39A
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

00:04:6b:2b:a3:7d:4a:fc:d5:18:b9:0c:fd:58:48:97:59:af:f1:59:fb:d4:dc:53:83:4c:49:af:cf:40:d1:f6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=76195629,CN=Hong Kong master science and technology Limited,O=Hong Kong master science and technology Limited,L=Hong Kong,C=HK,1.3.6.1.4.1.311.60.2.1.3=#1302484b,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 3, 2026

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

Serial Number

64:47:66:bb:43:72:52:c3:13:70:b8:af:26:66:47:ee

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 18, 2026 - May 18, 2027

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Minor OS version

Major OS version

Entry point

1460471

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\jekins_work\workspace\wmastercleanup_build\product\win32\dbginfo\uninstall.pdb

crypt32

CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

kernel32

WritePrivateProfileStringW InterlockedExchange lstrlenW OutputDebugStringW FreeResource GetCurrentThreadId InterlockedDecrement InterlockedIncrement OutputDebugStringA GetCurrentProcessId CreateProcessW lstrcmpW MapViewOfFileEx lstrcmpiW LoadLibraryExW GlobalFree GlobalUnlock GlobalLock GlobalAlloc WaitForMultipleObjects GetStdHandle GetEnvironmentVariableW GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW SwitchToFiber DeleteFiber CreateFiber FormatMessageW QueryPerformanceCounter ConvertFiberToThread ConvertThreadToFiber LoadLibraryA GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW VirtualProtect GetSystemTime WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage GetUserDefaultLCID FindFirstFileExW GetConsoleCP GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetACP GetDriveTypeW SetConsoleCtrlHandler ExitProcess FreeLibraryAndExitThread ExitThread GetCommandLineW GetCommandLineA SetStdHandle GetFullPathNameW RtlUnwind FormatMessageA PeekNamedPipe ExpandEnvironmentStringsA VerifyVersionInfoA QueryPerformanceFrequency GetSystemDirectoryA GetModuleHandleA VerSetConditionMask SleepEx LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList GetCPInfo GetStringTypeW LCMapStringW CompareStringW EncodePointer InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx GetLocaleInfoW ReadFile SetFilePointer CreateFileW CloseHandle GetFileSize HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap GetLastError MultiByteToWideChar GetLocalTime GetSystemDirectoryW SizeofResource LockResource LoadResource FindResourceW FindResourceExW WideCharToMultiByte FindFirstFileW FindClose GetSystemInfo InterlockedCompareExchange GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime Sleep SetFilePointerEx SetEndOfFile CreateFileMappingW CopyFileW MoveFileExW GetCurrentDirectoryW GetFileAttributesExW UnmapViewOfFile SetLastError FlushFileBuffers LocalFree DecodePointer RaiseException LocalAlloc MoveFileW SetFileAttributesW ResetEvent TerminateThread WaitForSingleObject SetEvent CreateThread CreateEventW GetPrivateProfileStringW GetPrivateProfileIntW GetTickCount GetVersionExW GetWindowsDirectoryW GetTempPathW InitializeCriticalSectionAndSpinCount TerminateProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot ExpandEnvironmentStringsW GetCurrentProcess OpenProcess GetProcAddress LoadLibraryW GetModuleHandleW QueryDosDeviceW GetLogicalDriveStringsW SystemTimeToFileTime RemoveDirectoryW DeleteFileW FindNextFileW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection FreeLibrary CreateDirectoryW GetFileAttributesW GetModuleFileNameW WriteFile VirtualQuery

user32

GetDesktopWindow RegisterWindowMessageW RegisterClassExW LoadCursorW DefWindowProcW FindWindowW ReleaseDC GetMonitorInfoW CharNextW LoadBitmapW SetWindowTextW GetWindowTextW GetWindowTextLengthW UnregisterClassW IsDialogMessageW GetWindow MapWindowPoints ScreenToClient SetFocus GetNextDlgTabItem ReleaseCapture GetCursorPos SetCapture CreateWindowExW FillRect IsChild GetFocus SetWindowRgn IsIconic GetProcessWindowStation GetUserObjectInformationW GetDC GetDlgItem ShowWindow SendMessageW GetDlgCtrlID DrawTextW InflateRect SetRect DrawIconEx PtInRect SetCursor DestroyIcon SetRectEmpty CopyRect IsWindow OffsetRect GetParent LoadImageW LoadIconW SetWindowPos InvalidateRect IsWindowVisible EqualRect SetWindowLongW GetWindowLongW CallWindowProcW KillTimer IntersectRect IsRectEmpty ClientToScreen DestroyWindow MoveWindow SetTimer PeekMessageW GetMessageW TranslateMessage DispatchMessageW PostThreadMessageW GetClientRect GetActiveWindow IsWindowEnabled EnableWindow GetWindowThreadProcessId GetForegroundWindow SystemParametersInfoW AttachThreadInput PostMessageW SetActiveWindow UpdateLayeredWindow GetWindowRect EndPaint BeginPaint GetClassInfoExW MessageBoxW MonitorFromWindow

gdi32

CreateSolidBrush CreateCompatibleBitmap CreateBitmap StretchBlt GetStretchBltMode SetStretchBltMode CreateRoundRectRgn SetViewportOrgEx GetTextMetricsW OffsetRgn ExtSelectClipRgn CombineRgn GetViewportOrgEx RoundRect CreateRectRgn GetClipRgn CreatePen MoveToEx LineTo CreateRectRgnIndirect SaveDC SelectClipRgn GetTextExtentPoint32W TextOutW RestoreDC CreateDIBSection BitBlt RectInRegion ExtTextOutW Rectangle GetCurrentObject GetTextColor SetTextColor SetBkMode SetBkColor DeleteDC CreateCompatibleDC GetObjectW GetStockObject CreateFontIndirectW DeleteObject SelectObject GetDeviceCaps

advapi32

ChangeServiceConfig2W RegCreateKeyExW RegOpenKeyW RegSetValueExW RegQueryValueExW RegDeleteKeyW RegEnumKeyExW RegOpenKeyExW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegDeleteValueW RegQueryInfoKeyW ControlService StartServiceW DeleteService RegCloseKey ChangeServiceConfigW CreateServiceW CloseServiceHandle QueryServiceStatus OpenServiceW OpenSCManagerW

shell32

SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFolderPathW ShellExecuteW ord680 ShellExecuteExW SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize

oleaut32

VarUI4FromStr SysFreeString

shlwapi

PathAppendW PathFindFileNameW StrToIntW PathAddBackslashW StrToIntA PathRemoveBackslashW PathStripPathW PathCanonicalizeW PathRemoveFileSpecW PathFileExistsW PathIsDirectoryW

comctl32

_TrackMouseEvent InitCommonControlsEx DrawShadowText

msimg32

AlphaBlend

gdiplus

GdipCreateBitmapFromScan0 GdipGetImagePixelFormat GdipGetImageGraphicsContext GdipDrawImagePointsRectI GdipSetPenStartCap GdipDeletePen GdipCreateHBITMAPFromBitmap GdipCreatePen1 GdipCreatePath GdipGraphicsClear GdipCreateBitmapFromStream GdipCloneBitmapArea GdipLoadImageFromStream GdipImageRotateFlip GdipFillRectangle GdipDrawLinesI GdipDrawImageRectI GdipStartPathFigure GdipAddPathLineI GdipScaleWorldTransform GdipFillPath GdipCreateLineBrushFromRectWithAngleI GdipSetPenDashStyle GdipDrawPath GdipAddPathArcI GdipDrawRectangleI GdipDrawLine GdipSetPenMode GdipDeletePath GdipAddPathPieI GdipAddPathRectangleI GdipClosePathFigure GdipSetSmoothingMode GdipSetClipPath GdipSetInterpolationMode GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipDrawImageRectRect GdipLoadImageFromFile GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipTranslateWorldTransform GdipRotateWorldTransform GdipDrawImageRectRectI GdipResetWorldTransform GdipFillRectangleI GdipCreateSolidFill GdipCloneBrush GdipDeleteBrush GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipSetTextRenderingHint GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipCreateFromHDC GdipDeleteGraphics GdiplusShutdown GdiplusStartup GdipNewPrivateFontCollection GdipDeletePrivateFontCollection GdipPrivateAddFontFile GdipGetFontCollectionFamilyCount GdipGetFontCollectionFamilyList GdipCloneFontFamily GdipDeleteFontFamily GdipCreateFont GdipAlloc GdipCreateFontFromLogfontW GdipDeleteFont GdipFree GdipSetStringFormatAlign GdipMeasureString GdipSetPenEndCap

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

bcrypt

BCryptGenRandom

wldap32

ord33 ord32 ord27 ord26 ord22 ord41 ord35 ord60 ord211 ord46 ord217 ord143 ord79 ord30 ord200 ord301 ord50

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

588KB

Virtual Size

587KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

548B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

723KB

Virtual Size

723KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=18, id=241, version=40116,

count=199, id=243, version=40116,

count=31, id=242, version=40116,

count=93, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=261, version=23013,

count=8, id=199, version=41118,

count=29, id=259, version=24123,

count=39, id=260, version=24123,

count=68, id=261, version=24123,

count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=22, productName=Unmarked objects (old),

count=556, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=577, id=1, productName=Unmarked objects,

count=93, id=264, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=2, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,