General
- Target 2026-08-31_98428c081f7e4632a5d07b215b31a38e_coinminer_elex_emotet_glassworm_icedid_remcos
- Size 10.6MB
- Sample260831-vdaqfadl8v
- SHA256 60acf77b59726bc0beb3fcc2b8468bda43e5c4057576de4591e2047f36c6947d
- MD5 98428c081f7e4632a5d07b215b31a38e
- SHA1 63143ec651bac88e7bb05f99224e642f56776596
- SHA512 d356fc8eacba10f9f98c235c530f24387f298e3ae2277e6567ec9af0d785689ab4ab3bec6ddce04ce4dd67d7d5ea3d69f3e3ff6322f552f496abbe49f53dd634
- SSDEEP 196608:OIWM3k8lYqsBmiFm4CTqfG+vTiwnDmNQkJM8uDIYnKOo7:6M3k8lD4F3e+biSDcQwM8uDu
- TLSH T139B6BF133530ED55E9881BBBD9A6433825666E44A8B1C017F70CBE6BBF310135B6EA1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-31_98428c081f7e4632a5d07b215b31a38e_coinminer_elex_emotet_glassworm_icedid_remcos.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-31_98428c081f7e4632a5d07b215b31a38e_coinminer_elex_emotet_glassworm_icedid_remcos.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-31_98428c081f7e4632a5d07b215b31a38e_coinminer_elex_emotet_glassworm_icedid_remcos
- Size 10.6MB
- SHA256 60acf77b59726bc0beb3fcc2b8468bda43e5c4057576de4591e2047f36c6947d
- MD5 98428c081f7e4632a5d07b215b31a38e
- SHA1 63143ec651bac88e7bb05f99224e642f56776596
- SHA512 d356fc8eacba10f9f98c235c530f24387f298e3ae2277e6567ec9af0d785689ab4ab3bec6ddce04ce4dd67d7d5ea3d69f3e3ff6322f552f496abbe49f53dd634
- SSDEEP 196608:OIWM3k8lYqsBmiFm4CTqfG+vTiwnDmNQkJM8uDIYnKOo7:6M3k8lD4F3e+biSDcQwM8uDu
- TLSH T139B6BF133530ED55E9881BBBD9A6433825666E44A8B1C017F70CBE6BBF310135B6EA1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL