2026-09-01_64abd2eca8f1e3a0eec1aeb80b407dce_coinminer_elex_graphican_hijackloader_luca-stealer_medusalocker_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-01_64abd2eca8f1e3a0eec1aeb80b407dce_coinminer_elex_graphican_hijackloader_luca-stealer_medusalocker_mespinoza_njrat
Size 513KB
Sample260903-mxsrcsvgjd
SHA256 ed352749548470b1a29cb51825d06da830f6ca8df3a07c22bf864c87b24e5c9d
MD5 64abd2eca8f1e3a0eec1aeb80b407dce
SHA1 936fa5b41f599e6425d5542a283bbb66596506f8
SHA512 9a529285a7ed287f996b14a3b6103b356b9e3bb474664be012a33b6556fcdee9637fa52b8d44ab9c761028861506e94e0ce04f2984a738c72167c82314ba5604
SSDEEP 12288:6l3d8OTBUr3ajX8dJcBVqgDnDDf5FPqKXG6BQAOsnTXB9cUd+H5pZAlMi:yN8OV/X8dJwDnDD1XvFnTXgH5clMi
TLSH
T103B49E10B6A1C136E55252B04EBDE76DA0BCF9A00B3741EF73D84E2E2E605D12B36677
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-01_64abd2eca8f1e3a0eec1aeb80b407dce_coinminer_elex_graphican_hijackloader_luca-stealer_medusalocker_mespinoza_njrat

File Explorer

2026-09-01_64abd2eca8f1e3a0eec1aeb80b407dce_coinminer_elex_graphican_hijackloader_luca-stealer_medusalocker_mespinoza_njrat

.exe 513KB

2026-09-01_64abd2eca8f1e3a0eec1aeb80b407dce_coinminer_elex_graphican_hijackloader_luca-stealer_medusalocker_mespinoza_njrat

IMPHASH 71c82d3900c1fb57f8b30daaa4eb4dc6
SHA256 ed352749548470b1a29cb51825d06da830f6ca8df3a07c22bf864c87b24e5c9d
MD5 64abd2eca8f1e3a0eec1aeb80b407dce
SHA1 936fa5b41f599e6425d5542a283bbb66596506f8
SHA512 9a529285a7ed287f996b14a3b6103b356b9e3bb474664be012a33b6556fcdee9637fa52b8d44ab9c761028861506e94e0ce04f2984a738c72167c82314ba5604
SSDEEP 12288:6l3d8OTBUr3ajX8dJcBVqgDnDDf5FPqKXG6BQAOsnTXB9cUd+H5pZAlMi:yN8OV/X8dJwDnDD1XvFnTXgH5clMi
TLSH
T103B49E10B6A1C136E55252B04EBDE76DA0BCF9A00B3741EF73D84E2E2E605D12B36677
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

48:9e:67:c0:c2:a0:85:3e:d5:05:4f:a8:1d:50:58:ca:d3:98:27:2b:92:3e:b9:36:ae:37:98:7a:7c:50:80:83

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=97108816,CN=日月晶耀股份有限公司,O=日月晶耀股份有限公司,ST=新竹市,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c09e58fb0e58c97e5b882,1.3.6.1.4.1.311.60.2.1.3=#13025457

Chains

Jan 1, 0001

Subject

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29

Issuer

CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

May 15, 2026

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

08:f1:33:89:7f:fb:11:6b:cf:e1:ce:20:be:4f:c2:0c

Issuer

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 27, 2024 - Sep 13, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Minor OS version

Major OS version

Entry point

176582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcessId ProcessIdToSessionId CloseHandle CreateEventW SetEvent LoadLibraryW GetProcAddress FreeLibrary HeapFree InitializeCriticalSectionEx HeapSize GetLastError HeapReAlloc WriteConsoleW GetTimeZoneInformation GetConsoleMode GetConsoleCP SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW RaiseException HeapAlloc DecodePointer DeleteCriticalSection ExitProcess GetProcessHeap WaitForSingleObject GetCommandLineW GetCommandLineA WTSGetActiveConsoleSessionId Sleep GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW GetStringTypeW SetStdHandle LCMapStringW CompareStringW GetFullPathNameW GetCurrentDirectoryW GetACP GetModuleHandleExW ExitThread GetFileType GetVersionExW GetModuleHandleA GlobalLock GlobalUnlock FileTimeToSystemTime SystemTimeToTzSpecificLocalTime WriteFile GetLocalTime LocalFree GetCurrentThreadId GetModuleHandleW CreateFileW GlobalAlloc ReadFile SetNamedPipeHandleState WaitNamedPipeA CreateNamedPipeA GetCurrentProcess DisconnectNamedPipe CreateFileA ConnectNamedPipe FlushFileBuffers SetLastError GetModuleFileNameW GetFileSize EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW GetTickCount FindNextFileW SetFilePointer FindClose GetDriveTypeW OpenProcess TerminateProcess CreateDirectoryW GetFileAttributesW GetFileSizeEx GetFileTime VirtualFree VirtualAlloc SetFilePointerEx PeekNamedPipe GetStdHandle TryEnterCriticalSection QueryPerformanceCounter QueryPerformanceFrequency DuplicateHandle WaitForSingleObjectEx GetCurrentThread GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW CreateTimerQueue SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait EncodePointer GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW VirtualProtect ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind

user32

SetWindowLongW GetWindowTextW IsClipboardFormatAvailable GetClipboardData CloseClipboard GetDlgItem ChangeClipboardChain SetClipboardViewer GetCursorPos ReleaseDC OpenWindowStationW GetProcessWindowStation SystemParametersInfoW DrawIconEx OpenInputDesktop SetProcessWindowStation CloseDesktop OpenClipboard SetThreadDesktop GetIconInfo CloseWindowStation GetDC KillTimer SetLayeredWindowAttributes SetTimer EnumDisplayMonitors BeginPaint SetClipboardData mouse_event ExitWindowsEx EmptyClipboard keybd_event MapVirtualKeyW PostQuitMessage LoadCursorW LoadIconW TranslateMessage GetForegroundWindow SendDlgItemMessageW DispatchMessageW ShowWindow RegisterClassExW SetWindowTextW UnregisterClassW GetSystemMetrics SendMessageW CreateWindowExW DestroyWindow DefWindowProcW GetMessageW GetWindowTextLengthW GetWindowLongW PostThreadMessageW FindWindowW PostMessageW GetCursorInfo UpdateWindow SetWindowPos EndPaint GetThreadDesktop LoadAcceleratorsW LoadStringW TranslateAcceleratorW

gdi32

DeleteObject CreateSolidBrush CreateFontW DeleteDC CreateCompatibleDC CreateDIBSection SelectObject BitBlt ExtTextOutW SetTextAlign SetTextColor GetTextExtentPoint32W GetStockObject Rectangle

advapi32

ReportEventW RegisterEventSourceW DeregisterEventSource GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW OpenProcessToken CryptReleaseContext CryptGetHashParam RegOpenKeyExA CryptDestroyHash CryptHashData CryptCreateHash RegQueryValueExA CryptAcquireContextW RegCloseKey RevertToSelf ImpersonateLoggedOnUser ConvertSidToStringSidW AdjustTokenPrivileges LookupPrivilegeValueA RegOpenKeyExW RegQueryValueExW

shell32

SHGetSpecialFolderPathW SHGetPathFromIDListW

ole32

CoCreateGuid CoInitializeEx CoTaskMemFree CoCreateInstance CoUninitialize

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

ws2_32

recv closesocket send ioctlsocket htons getsockopt inet_ntoa socket inet_addr WSAStartup connect select gethostbyname WSACleanup

shlwapi

PathCanonicalizeW

comctl32

ord17

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

oleaut32

VariantClear

Name

.text

Size

358KB

Virtual Size

357KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-01_64abd2eca8f1e3a0eec1aeb80b407dce_coinminer_elex_graphican_hijackloader_luca-stealer_medusalocker_mespinoza_njrat

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

wtsapi32

ws2_32

shlwapi

comctl32

userenv

oleaut32

generic