2026-08-26_f243f49330c0380645a9e0862261e461_coinminer_elex_emotet_glassworm_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-26_f243f49330c0380645a9e0862261e461_coinminer_elex_emotet_glassworm_wannacry
Size 2.5MB
Sample260827-dedeaadj4z
SHA256 cc3c655430e7f805b4a3523bca244c3a6699502e78837999bac55bbbd7f57549
MD5 f243f49330c0380645a9e0862261e461
SHA1 65096118b0f86312ba5a3e0a28d046812cfeeaef
SHA512 64893bcb3ed8406a6fab8b35d94165ae737d57ecde86195ed6a4f5a815703adb508155da1284a04ee61553c1d281d72dd5ad05a53e48d9716869ddb633a694be
SSDEEP 49152:SzsmGYLcnrpeHoALVRICIK+YLy8bMAig0Vs0nrWbnbDFt3:StGYLcFeHHVl+Iy8bggR0Et3
TLSH
T16EC5AE127580C03AD66305708EBE377996BCFB650B750AC373C8DD1C5AB59E2A63722B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-26_f243f49330c0380645a9e0862261e461_coinminer_elex_emotet_glassworm_wannacry

File Explorer

2026-08-26_f243f49330c0380645a9e0862261e461_coinminer_elex_emotet_glassworm_wannacry

.exe 2.5MB

2026-08-26_f243f49330c0380645a9e0862261e461_coinminer_elex_emotet_glassworm_wannacry

IMPHASH cd2d56209f4230f71d7feaf446c48847
SHA256 cc3c655430e7f805b4a3523bca244c3a6699502e78837999bac55bbbd7f57549
MD5 f243f49330c0380645a9e0862261e461
SHA1 65096118b0f86312ba5a3e0a28d046812cfeeaef
SHA512 64893bcb3ed8406a6fab8b35d94165ae737d57ecde86195ed6a4f5a815703adb508155da1284a04ee61553c1d281d72dd5ad05a53e48d9716869ddb633a694be
SSDEEP 49152:SzsmGYLcnrpeHoALVRICIK+YLy8bMAig0Vs0nrWbnbDFt3:StGYLcFeHHVl+Iy8bggR0Et3
TLSH
T16EC5AE127580C03AD66305708EBE377996BCFB650B750AC373C8DD1C5AB59E2A63722B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

8a:c7:cc:9b:a2:29:da:e2:bf:87:3c:c9:e4:5c:8c:c3

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Chains

Jan 1, 0001

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Serial Number

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Timespan

Aug 1, 1996 - Dec 31, 2020

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Serial Number

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Aug 6, 2003 - Aug 5, 2013

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Serial Number

38:63:1f:3f:1e:79:39:ba:30:df:b5:64:7c:1a:1a:ad

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Mar 13, 2008 - Mar 13, 2009

Minor OS version

Major OS version

Entry point

427254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

timeGetTime PlaySoundA

dinput8

DirectInput8Create

kernel32

DeviceIoControl HeapFree HeapAlloc IsBadReadPtr UnmapViewOfFile MapViewOfFile CreateFileMappingA FormatMessageA LockFile UnlockFile lstrcpyA EnumResourceLanguagesA ConvertDefaultLocale lstrcmpA GlobalDeleteAtom GlobalAddAtomA lstrcmpW lstrcatA GlobalFindAtomA GlobalGetAtomNameA GlobalFlags GlobalReAlloc GlobalHandle LocalReAlloc TlsFree SetErrorMode GetFileTime GetCPInfo GetOEMCP GetVolumeInformationA ExitProcess VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapReAlloc GetSystemTimeAsFileTime GetFileType GetStartupInfoA GetCommandLineA GetDriveTypeA HeapSize HeapDestroy HeapCreate VirtualFree IsBadWritePtr LCMapStringA LCMapStringW GetTimeZoneInformation SetHandleCount GetStdHandle SetStdHandle UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetStringTypeA GetStringTypeW IsBadCodePtr EnumSystemLocalesA IsValidLocale IsValidCodePage SetEnvironmentVariableA SetLastError WritePrivateProfileStringA VirtualProtectEx TlsAlloc TlsSetValue TlsGetValue FlushFileBuffers MoveFileA GetFileAttributesExA GetCurrentDirectoryA GetCurrentThread SetThreadAffinityMask QueryPerformanceCounter QueryPerformanceFrequency GetWindowsDirectoryA LocalAlloc LocalFree DuplicateHandle GetPrivateProfileStringA FileTimeToSystemTime GetFileSize SetEndOfFile SetFilePointer WriteFile ReadFile GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime TerminateThread GetFullPathNameA LocalFileTimeToFileTime SetFileTime SetFileAttributesA DosDateTimeToFileTime CreateDirectoryA FindNextFileA FindFirstFileA CopyFileA CompareStringA CompareStringW GetVersion EnumResourceNamesA CreateThread DeleteFileA ReleaseMutex CreateMutexA ResumeThread GetCurrentProcess VirtualAllocEx WriteProcessMemory LoadLibraryA CreateRemoteThread VirtualFreeEx GetCurrentProcessId GlobalAlloc GlobalLock GlobalUnlock GlobalFree LockResource FreeResource MulDiv LoadLibraryW GetProcAddress FindFirstFileW FindNextFileW FindClose GetModuleFileNameW GetFileAttributesW GetNumberFormatW GetDateFormatW GetUserDefaultLCID GetUserGeoID GetUserDefaultUILanguage GetSystemDefaultLangID GetLocaleInfoW EnterCriticalSection LeaveCriticalSection RaiseException DeleteCriticalSection IsDBCSLeadByte lstrcpynA lstrcmpiA LoadLibraryExA FindResourceA LoadResource SizeofResource FreeLibrary GetLastError MultiByteToWideChar GetModuleFileNameA lstrlenA GetModuleHandleA InterlockedDecrement InterlockedIncrement InitializeCriticalSection OpenProcess OpenThread GetExitCodeProcess CreateEventA TerminateProcess ResetEvent SetEvent SetUnhandledExceptionFilter IsDebuggerPresent WaitForSingleObject Sleep WideCharToMultiByte lstrlenW CreateFileA GetTickCount GetCurrentThreadId GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange GetVersionExA GetFileAttributesA CreateProcessA CloseHandle RtlUnwind

user32

PostThreadMessageA MessageBeep GetNextDlgGroupItem InvalidateRgn CopyAcceleratorTableA SetRect IsRectEmpty GetSysColorBrush DestroyMenu WinHelpA GetCapture CreateWindowExA GetClassLongA GetClassInfoExA SetPropA GetPropA RemovePropA IsChild GetTopWindow GetMessageTime GetMessagePos MapWindowPoints UpdateWindow GetMenu AdjustWindowRectEx EqualRect GetClassInfoA RegisterClassA DefWindowProcA CallWindowProcA CopyRect RegisterWindowMessageA RegisterClipboardFormatA SetWindowContextHelpId MapDialogRect SetMenuItemBitmaps ModifyMenuA CheckMenuItem GetMenuCheckMarkDimensions SetWindowsHookExA CallNextHookEx GetMessageA TranslateMessage DispatchMessageA GetKeyState PeekMessageA ValidateRect MessageBoxA GetLastActivePopup UnhookWindowsHookEx GetSysColor EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringA DrawTextExA DrawTextA TabbedTextOutA GetMenuState GetSubMenu GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamA DestroyWindow GetNextDlgTabItem EndDialog GetWindowTextA GetFocus SetWindowPos IsWindowEnabled SetWindowLongA GetDlgCtrlID SetWindowTextA GetWindowLongA IsDialogMessageA SendDlgItemMessageA GetDlgItem GetWindow ChangeDisplaySettingsA EnumDisplaySettingsA GetDC ReleaseDC CharUpperA EnableWindow EnableMenuItem SetWindowRgn GetClientRect IsIconic DrawIcon InvalidateRect SendMessageA SetTimer GetSystemMenu InsertMenuA GetMenuItemCount LoadIconA LoadStringW MessageBoxW CharLowerBuffA OffsetRect SetCapture ReleaseCapture LoadCursorA SetCursor IsWindow GetCursorPos PtInRect LoadBitmapA CharLowerBuffW UnregisterClassA CharNextA PostQuitMessage wsprintfA FindWindowExA SetWindowPlacement WaitForInputIdle SystemParametersInfoA MoveWindow GetClassNameA PostMessageA ShowWindow GetWindowPlacement SendInput GetLastInputInfo GetForegroundWindow AttachThreadInput SetForegroundWindow SetFocus FindWindowA EnumWindows GetWindowThreadProcessId IsWindowVisible GetWindowRect GetSystemMetrics IntersectRect GetParent GetMenuItemID

gdi32

ScaleViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutA TextOutA RectVisible PtVisible GetRgnBox GetTextColor GetBkColor GetMapMode CreateRectRgnIndirect GetStockObject CreateBitmap DeleteDC ExtSelectClipRgn ScaleWindowExtEx CreateCompatibleDC SetViewportExtEx GetObjectA GetWindowExtEx GetViewportExtEx DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateRectRgn CreateRoundRectRgn BitBlt GetDeviceCaps SetWindowExtEx

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

RegQueryValueExA RegEnumKeyExA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCreateKeyExA RegSetValueExA RegQueryInfoKeyA RegQueryValueA RegEnumKeyA RegOpenKeyA RegCloseKey GetUserNameA RegSetKeySecurity ImpersonateSelf RevertToSelf

shell32

SHGetSpecialFolderPathA ShellExecuteExA SHGetFileInfoA SHFileOperationA

comctl32

ord17

shlwapi

PathStripToRootA PathIsUNCA PathFindExtensionA PathFileExistsA PathFindFileNameA

oledlg

ord8

ole32

StgCreateDocfileOnILockBytes CreateStreamOnHGlobal CreateILockBytesOnHGlobal CoTaskMemAlloc CoTaskMemFree CoUninitialize CoInitialize CoCreateInstance CoRevokeClassObject StringFromCLSID CoCreateGuid CLSIDFromString CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CLSIDFromProgID OleUninitialize CoFreeUnusedLibraries OleInitialize CoGetClassObject StgOpenStorageOnILockBytes CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoTaskMemRealloc

oleaut32

DispCallFunc OleCreateFontIndirect SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy SafeArrayCreate SafeArrayGetElemsize SafeArrayAccessData SafeArrayUnaccessData VariantCopy SysStringByteLen SysAllocStringByteLen VariantChangeType SysAllocStringLen SysAllocString OleLoadPicture SysStringLen LoadTypeLi LoadRegTypeLi SysFreeString VarUI4FromStr VariantClear VariantInit

urlmon

URLDownloadToCacheFileA

ws2_32

WSAStartup gethostname gethostbyname WSACleanup ntohl

wininet

HttpOpenRequestA InternetGetLastResponseInfoA InternetReadFile InternetCloseHandle InternetOpenA InternetConnectA HttpAddRequestHeadersA HttpQueryInfoA HttpSendRequestA InternetQueryOptionA

iphlpapi

GetAdaptersInfo

Name

.text

Size

600KB

Virtual Size

597KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.pecode

Size

56KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pccode

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

160KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.phs

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

56KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-26_f243f49330c0380645a9e0862261e461_coinminer_elex_emotet_glassworm_wannacry

PE Signature issue

winmm

dinput8

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

urlmon

ws2_32

wininet

iphlpapi

generic