2026-09-16_ea556628b02b7a20ce6a38ba8c2d3efb_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_ea556628b02b7a20ce6a38ba8c2d3efb_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_remcos_revil
Size 4.4MB
Sample260916-j5devsxdnf
SHA256 f23d282a1ac1e45f6fb82ac08c5fd1dcb8e58f34feede7712cd557c9a7a5a98d
MD5 ea556628b02b7a20ce6a38ba8c2d3efb
SHA1 8d87365318f06464a66c53ebdb2b5cc08195ee92
SHA512 9f73866a2d4939b528969c1ed5e9bda7c07d751a69b898346cedb44c1422adb7fefb589272605a664894a5ba381723fd7879ff068c017533515396d380be0821
SSDEEP 49152:+fNrbjA4R3Z5ccMOo6arArTF4gRZBzYFBV2sL4OpzZvGIWImVs1txvCLwT+hl3l7:+fNrA46twrTFzIWZVqSJAbfwAofFm
TLSH
T152266C32FA8B4C73D5911276496F76669A6F6E10072187C3A2D82BE92F301D13E3735E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_ea556628b02b7a20ce6a38ba8c2d3efb_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_remcos_revil

File Explorer

2026-09-16_ea556628b02b7a20ce6a38ba8c2d3efb_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_remcos_revil

.exe 4.4MB

2026-09-16_ea556628b02b7a20ce6a38ba8c2d3efb_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_remcos_revil

IMPHASH dbe7771e35f0897364b40a5511e1be39
SHA256 f23d282a1ac1e45f6fb82ac08c5fd1dcb8e58f34feede7712cd557c9a7a5a98d
MD5 ea556628b02b7a20ce6a38ba8c2d3efb
SHA1 8d87365318f06464a66c53ebdb2b5cc08195ee92
SHA512 9f73866a2d4939b528969c1ed5e9bda7c07d751a69b898346cedb44c1422adb7fefb589272605a664894a5ba381723fd7879ff068c017533515396d380be0821
SSDEEP 49152:+fNrbjA4R3Z5ccMOo6arArTF4gRZBzYFBV2sL4OpzZvGIWImVs1txvCLwT+hl3l7:+fNrA46twrTFzIWZVqSJAbfwAofFm
TLSH
T152266C32FA8B4C73D5911276496F76669A6F6E10072187C3A2D82BE92F301D13E3735E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2092511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Prog\CrashRptRail\bin\rail_crash_sender.pdb

kernel32

ReadProcessMemory LoadLibraryW GetProcAddress FreeLibrary GetProcessTimes FileTimeToSystemTime GetSystemTime GetFileAttributesW GetCurrentThreadId GetCommandLineW CreateThread GetCurrentProcess ReadFile WriteFile CreateProcessW GetFileInformationByHandle CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId TerminateProcess DeleteFileW RemoveDirectoryW Sleep GetTickCount RaiseException DecodePointer OutputDebugStringA CreateDirectoryW WritePrivateProfileStringW GetModuleHandleExW GetModuleFileNameW GetTempPathW GetPrivateProfileStringW FormatMessageW GetFileAttributesExW GlobalAlloc GlobalFree SystemTimeToFileTime GetModuleHandleW SystemTimeToTzSpecificLocalTime GetTempFileNameW TryEnterCriticalSection CreateMutexA ReleaseMutex OpenFileMappingW UnmapViewOfFile GetSystemInfo CreateFileMappingW MapViewOfFile TzSpecificLocalTimeToSystemTime SetFileTime CopyFileA UnlockFileEx UnlockFile LockFileEx LockFile GetFileSize GetFileAttributesA DeleteFileA CreateFileA CreateDirectoryA Module32First FindClose FindNextFileW GetFileTime FindFirstFileW GetFileSizeEx CreateFileW MultiByteToWideChar WaitForSingleObject SetEvent LeaveCriticalSection Process32Next Process32First GetVersionExA GetLocalTime SetFilePointer GenerateConsoleCtrlEvent FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP ResetEvent IsValidCodePage FindFirstFileExA EnterCriticalSection GetProcessHeap CloseHandle HeapSize CreatePipe GetExitCodeProcess FlushFileBuffers GetTimeZoneInformation SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW ReadConsoleW GetACP HeapReAlloc MoveFileExW GetCurrentDirectoryW GetCurrentDirectoryA SetCurrentDirectoryW SetCurrentDirectoryA SetEnvironmentVariableW SetEnvironmentVariableA GetFullPathNameA GetFullPathNameW HeapFree HeapAlloc SetConsoleMode ReadConsoleInputA PeekConsoleInputA GetNumberOfConsoleInputEvents ResumeThread ExitThread ExitProcess SetConsoleCtrlHandler WriteConsoleW GetModuleFileNameA GetConsoleMode GetConsoleCP CreateProcessA GetDriveTypeW RtlUnwind WaitForMultipleObjectsEx UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore SetProcessAffinityMask VirtualProtect VirtualFree CreateEventW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError VirtualAlloc WideCharToMultiByte OpenProcess GetVersionExW LoadLibraryExW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle InitializeCriticalSection GetTempPathA GetWindowsDirectoryA GetComputerNameA GetSystemTimeAsFileTime GetModuleHandleA GetFileType SetLastError FormatMessageA SleepEx VerifyVersionInfoA GetSystemDirectoryA LoadLibraryA VerSetConditionMask ExpandEnvironmentStringsA WaitForMultipleObjects PeekNamedPipe FindFirstFileA FindNextFileA GlobalMemoryStatus QueryPerformanceCounter FlushConsoleInputBuffer IsDebuggerPresent OutputDebugStringW QueryPerformanceFrequency FindFirstFileExW GetDiskFreeSpaceExW SetEndOfFile SetFileAttributesW SetFilePointerEx CopyFileW CreateHardLinkW AreFileApisANSI GetStringTypeW QueueUserWorkItem RtlCaptureStackBackTrace IsProcessorFeaturePresent EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree DuplicateHandle WaitForSingleObjectEx GetCurrentThread GetExitCodeThread GetNativeSystemInfo CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead CreateTimerQueue SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread

user32

GetDC GetUserObjectInformationW GetProcessWindowStation GetGuiResources UnregisterClassW ReleaseDC MessageBoxA

shell32

SHGetFileInfoW SHFileOperationW CommandLineToArgvW SHGetSpecialFolderPathW ExtractIconW

ole32

CoUninitialize CoCreateInstance CoCreateGuid CoInitialize

advapi32

OpenProcessToken AdjustTokenPrivileges RegOpenKeyExW RegQueryInfoKeyW RegEnumKeyExW DeregisterEventSource ReportEventA RegisterEventSourceA RegQueryValueExW RegCloseKey RegEnumValueW LookupPrivilegeValueW

ws2_32

setsockopt send recv WSAGetLastError WSACleanup WSAStartup getsockopt connect ntohs gethostname socket getsockname WSASetLastError inet_addr closesocket WSAIoctl bind __WSAFDIsSet ioctlsocket freeaddrinfo getaddrinfo select htonl ntohl sendto recvfrom listen shutdown getservbyname gethostbyname accept htons getpeername inet_ntoa

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

psapi

GetProcessMemoryInfo

wldap32

ord60 ord143 ord41 ord26 ord33 ord22 ord211 ord301 ord46 ord27 ord32 ord200 ord50 ord30 ord79 ord35

normaliz

IdnToUnicode IdnToAscii

gdi32

GetDeviceCaps GetDIBits DeleteObject GetObjectA CreateCompatibleBitmap

shlwapi

PathFileExistsW

winmm

timeBeginPeriod timeKillEvent timeGetDevCaps timeSetEvent

generic

count=24, id=241, version=40116,

count=206, id=243, version=40116,

count=30, id=242, version=40116,

count=1, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=20, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=9, id=199, version=41118,

count=26, id=259, version=24123,

count=127, id=261, version=24123,

count=39, id=260, version=24123,

count=2, id=261, version=23013,

count=6, id=203, version=65501,

count=4, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=2, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=316, id=1, productName=Unmarked objects,

count=654, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,