2026-09-12_2203b69d27211e2e0a4b1db1baeec671_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-09-12_2203b69d27211e2e0a4b1db1baeec671_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 14.6MB
Sample260913-fs14lsfd28
SHA256 02b2e085823bbd3dfa6a032aa112ee62324aca42c958938c889f16d956347333
MD5 2203b69d27211e2e0a4b1db1baeec671
SHA1 4830a15785de4828c6337ab6a287dc3036f498ce
SHA512 da0c7bc9ebeb297f92eebc7036867c46b59900528bb8f0f435ca59b7259940425115f27f4d688ea321c93634441bbbd911caa1f2806987da8c4ad048176c9f6f
SSDEEP 196608:TBWQKBWQyBWQKBWQqFeGZF6bUpMBF1p/kjRm4OWi2b:TBJKBJyBJKBJq5IbUwF1VERmj2b
TLSH
T15EF6E12277D48036E0B302719AB1F7216AF9BC35AB21D6CB6389573D1E713D0DA3935A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-12_2203b69d27211e2e0a4b1db1baeec671_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

2026-09-12_2203b69d27211e2e0a4b1db1baeec671_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 14.6MB
downloader_req.pyc

574B

SHA256 02b2e085823bbd3dfa6a032aa112ee62324aca42c958938c889f16d956347333
MD5 2203b69d27211e2e0a4b1db1baeec671
SHA1 4830a15785de4828c6337ab6a287dc3036f498ce
SHA512 da0c7bc9ebeb297f92eebc7036867c46b59900528bb8f0f435ca59b7259940425115f27f4d688ea321c93634441bbbd911caa1f2806987da8c4ad048176c9f6f
SSDEEP 196608:TBWQKBWQyBWQKBWQqFeGZF6bUpMBF1p/kjRm4OWi2b:TBJKBJyBJKBJq5IbUwF1VERmj2b
TLSH
T15EF6E12277D48036E0B302719AB1F7216AF9BC35AB21D6CB6389573D1E713D0DA3935A
MD5 SHA1 SHA512 SSDEEP TLSH

UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

53760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths