Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    2026-09-07_c23e39e82b4741c4b929ac4af9ec4088_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader
  • Size 6.0MB
  • SHA256 2392f0f4b73626883484f21030fb85c2e9773057a7b80b98d6bd2686d38fd89f
  • MD5 c23e39e82b4741c4b929ac4af9ec4088
  • SHA1 52d8af7d1724011214aa8d5ba2cfef7f652a59b9
  • SHA512 36e4588a0f897add0e6b69f33d51bff9256e7a7941bcf05b09365da69ca77c8f265d0daea28a3a62de31bdbd15a832f1ea95924cc5417618d90df5c468addee5
  • SSDEEP 98304:RSGSThOfTCiFBXmfFs+JMHpCVoR8oMEOJ6Ty3RvX+Y2naq8le+:ZBfTCiUswVSLOJgyBG/aW+
  • TLSH
    T18D563362F440E436E038203925F684A6B17DFD7347254A8B73A93A364D793D836BDB4E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxmrigminerpersistenceprivilege_escalationpyinstallerupx

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • UPX dump on OEP (original entry point)

  • XMRig Miner payload

    miner

  • Boot or Logon Autostart Execution: Port Monitors

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2