2026-09-16_c9fb0a5cacaced5623970013c1fd8c0a_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_magniber_medusalocker_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_c9fb0a5cacaced5623970013c1fd8c0a_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_magniber_medusalocker_njrat_remcos_revil
Size 19.8MB
Sample260916-k2zpcsxhpb
SHA256 0c1947d7b23751913ad873c724087ef661989438e961c0d24f87a09df7a9d29a
MD5 c9fb0a5cacaced5623970013c1fd8c0a
SHA1 0ce5d07265382574e09093126b01de0fb08c1337
SHA512 e0d1e32c5cc12768bdd60721774930a2e94984774e8c2669dd4ff0fad0a5c2b82ec5a1f20b7a1505dc733245bdb14cc5bedb2de9d5305c56a3a967996fea7452
SSDEEP 393216:Yesh2dssoUFHuRgRr1OkHWBBOUfeUJ+fKIdfcZcqO89YdEG3ldBHwRXd383z:5pHu01Okgo6/J+fKIdfovBGdEGYN383z
TLSH
T1FB270202BA52C4B1C6D3413186A9B3BB267EA5254F75C1D3B3E04E2E4E704C1EE7679B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-16_c9fb0a5cacaced5623970013c1fd8c0a_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_magniber_medusalocker_njrat_remcos_revil

.exe 19.8MB

2026-09-16_c9fb0a5cacaced5623970013c1fd8c0a_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_magniber_medusalocker_njrat_remcos_revil

IMPHASH aeb60504157277657640c64c52d0c67b
SHA256 0c1947d7b23751913ad873c724087ef661989438e961c0d24f87a09df7a9d29a
MD5 c9fb0a5cacaced5623970013c1fd8c0a
SHA1 0ce5d07265382574e09093126b01de0fb08c1337
SHA512 e0d1e32c5cc12768bdd60721774930a2e94984774e8c2669dd4ff0fad0a5c2b82ec5a1f20b7a1505dc733245bdb14cc5bedb2de9d5305c56a3a967996fea7452
SSDEEP 393216:Yesh2dssoUFHuRgRr1OkHWBBOUfeUJ+fKIdfcZcqO89YdEG3ldBHwRXd383z:5pHu01Okgo6/J+fKIdfovBGdEGYN383z
TLSH
T1FB270202BA52C4B1C6D3413186A9B3BB267EA5254F75C1D3B3E04E2E4E704C1EE7679B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

bb:3b:bd:ac:f1:de:94:35:d3:b7:75:95:c2:ee:ed:0a:15:00:65:18:f3:93:04:57:8a:c1:b9:1d:0f:bc:81:be

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510100677184972A,CN=四川迅游网络科技股份有限公司,O=四川迅游网络科技股份有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Sep 26, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:5d:45:23:54:52:ea:9e:e9:0c:37:04:98:8e:02:8e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 21, 2022 - May 2, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

842491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualAlloc VirtualFree GetCurrentDirectoryW GetFileInformationByHandle GetStdHandle SetFileTime SetFilePointer SetEndOfFile GetFileSize CompareFileTime GetModuleHandleA LoadLibraryA lstrlenA CreateFileMappingW UnmapViewOfFile MapViewOfFile InterlockedCompareExchange IsBadReadPtr GetSystemTime GetVersionExA GetLocalTime GetVersionExW GetTickCount MulDiv GetFullPathNameW EnumResourceNamesW EnumResourceTypesW FreeResource GetCurrentThreadId GetCurrentProcess HeapCreate FlushInstructionCache InterlockedDecrement InterlockedIncrement FreeLibrary LoadLibraryW GetDiskFreeSpaceExW WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle GetTimeZoneInformation EnumSystemLocalesW OpenProcess IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP FlushFileBuffers SetConsoleCtrlHandler GetACP ExitProcess ExitThread SystemTimeToTzSpecificLocalTime GetDriveTypeW GetFileAttributesExW GetCommandLineW GetCommandLineA RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue SystemTimeToFileTime ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber GetModuleHandleExW SetConsoleMode ReadConsoleW ReadConsoleA GetConsoleMode GetEnvironmentVariableW WaitForMultipleObjects PeekNamedPipe GetFileType GetEnvironmentVariableA WaitForSingleObject MoveFileExA VerifyVersionInfoW VerSetConditionMask SleepEx FormatMessageA SwitchToThread InitializeSListHead GetStartupInfoW GetVolumePathNameW TerminateProcess InitializeCriticalSection LeaveCriticalSection EnterCriticalSection SetFilePointerEx FileTimeToSystemTime SetFileAttributesW GetSystemDirectoryW SetLastError GetFileSizeEx ReadFile CreateDirectoryW SetCurrentDirectoryW CreateMutexW GetModuleFileNameW lstrcmpW lstrcpyW WideCharToMultiByte GetModuleHandleW GetCurrentProcessId GetProcAddress FindResourceW LoadResource CloseHandle DeleteFileW LockResource lstrcatW Sleep MultiByteToWideChar GetFileAttributesW CreateFileW FindClose RemoveDirectoryW OutputDebugStringA WriteFile FindNextFileW FindFirstFileW SizeofResource GetProcessHeap IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter ResetEvent SetEvent GlobalUnlock GlobalLock GlobalAlloc LocalFree GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize TlsAlloc CreateEventW InitializeCriticalSectionAndSpinCount QueryPerformanceFrequency QueryPerformanceCounter EncodePointer GetExitCodeThread GetCurrentThread WaitForSingleObjectEx DuplicateHandle TryEnterCriticalSection FormatMessageW OutputDebugStringW IsDebuggerPresent InitializeCriticalSectionEx GetUserDefaultLCID HeapFree

user32

SetFocus GetDlgCtrlID GetUserObjectInformationW GetProcessWindowStation DrawIconEx GetWindowDC UnregisterClassW EnumWindows GetPropW PostMessageW GetWindowThreadProcessId IsIconic SetForegroundWindow FindWindowW BringWindowToTop ShowWindow GetActiveWindow GetCapture DestroyIcon OffsetRect CopyRect GetDlgItem SystemParametersInfoW ReleaseDC MonitorFromRect IsWindowVisible SetWindowRgn InvalidateRect SetWindowTextW GetWindowTextW GetClientRect CreateCaret HideCaret ShowCaret ClientToScreen IsWindowEnabled KillTimer SetTimer ReleaseCapture MessageBoxW SetCapture GetDC GetWindowRect SendMessageW SendNotifyMessageW DefWindowProcW CallWindowProcW RegisterClassExW CreateWindowExW IsWindow DestroyWindow IsZoomed SetWindowPos MoveWindow SetLayeredWindowAttributes InflateRect TrackMouseEvent CharUpperW MapVirtualKeyA CharLowerBuffW GetForegroundWindow CallMsgFilterW CheckMenuRadioItem GetMenuContextHelpId SetMenuContextHelpId GetMenuItemInfoW SetMenuInfo GetMenuInfo TrackPopupMenu DeleteMenu AppendMenuW InsertMenuW GetMenuItemCount GetSubMenu CheckMenuItem DestroyMenu CreatePopupMenu IsMenu SetCaretPos SystemParametersInfoA DrawTextW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetSystemMetrics GetSysColor EnableMenuItem SetRect WaitMessage PostThreadMessageW PeekMessageW DispatchMessageW TranslateMessage DestroyCursor GetDesktopWindow SetActiveWindow EnableWindow GetIconInfo CharNextW WindowFromPoint GetClassNameW GetCursorPos EndPaint BeginPaint UpdateWindow AnimateWindow ScreenToClient LoadImageW CreateIconFromResource LoadBitmapW PtInRect EqualRect IsRectEmpty UnionRect IntersectRect SetCursor GetKeyState GetFocus PostQuitMessage GetMonitorInfoW MonitorFromWindow LoadCursorW GetWindow SetParent GetParent SetWindowLongW GetWindowLongW MapWindowPoints UpdateLayeredWindow

gdi32

SetGraphicsMode SelectObject DeleteDC CreateCompatibleDC CreateBitmap EnumFontsW DeleteObject RectInRegion ExcludeClipRect BitBlt GetClipBox GetDeviceCaps RemoveFontMemResourceEx ExtCreateRegion IntersectClipRect SelectClipRgn SetWorldTransform CreateDIBSection GetCurrentObject GetViewportOrgEx CreateFontIndirectW GetStockObject Rectangle SetBkMode GetObjectW StretchBlt SetViewportOrgEx SetTextColor SetTextAlign GetTextMetricsW ExtTextOutW GetTextFaceW CreateSolidBrush EnumFontFamiliesExW GetCharABCWidthsW GetFontData GetGlyphOutlineW GetOutlineTextMetricsW GetFontUnicodeRanges GetGlyphIndicesW GetTextExtentPointI AddFontMemResourceEx GdiFlush

advapi32

RegisterEventSourceW ReportEventW CryptGenRandom CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptSignHashW CryptEnumProvidersW CryptDestroyKey CryptAcquireContextW CryptDecrypt CryptCreateHash CryptDeriveKey CryptHashData CryptDestroyHash DeregisterEventSource CryptReleaseContext RegCloseKey RegDeleteKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegQueryValueExW

shell32

SHCreateDirectoryExW SHGetPathFromIDListW SHGetSpecialFolderLocation SHBrowseForFolderW ShellExecuteW

ole32

CreateBindCtx CLSIDFromProgID OleUninitialize OleInitialize CreateStreamOnHGlobal IIDFromString CoCreateGuid CoInitialize CoUninitialize CoCreateInstance RegisterDragDrop OleLockRunning CLSIDFromString CoTaskMemFree

oleaut32

SysStringLen SysAllocStringLen SysFreeString SysAllocString

shlwapi

PathRemoveFileSpecW PathRemoveBackslashW PathCombineW StrToIntExW PathFileExistsW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wldap32

ord216 ord14 ord219 ord145 ord46 ord73 ord208 ord41 ord117 ord26 ord27 ord127 ord167 ord142 ord79 ord133 ord147 ord301

crypt32

CertFindCertificateInStore CertDuplicateCertificateContext CertGetCertificateContextProperty CertOpenStore CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext

imm32

ImmDestroyContext ImmGetContext ImmAssociateContext ImmCreateContext ImmReleaseContext

gdiplus

GdipBitmapLockBits GdipFree GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectI GdipGraphicsClear GdipDeleteGraphics GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipCreateBitmapFromFile GdipAlloc

ws2_32

recvfrom getnameinfo ntohl gethostname sendto shutdown freeaddrinfo getaddrinfo select __WSAFDIsSet socket WSAStartup closesocket recv send WSAGetLastError bind connect getpeername getsockname getsockopt htons ntohs setsockopt WSASetLastError WSAIoctl WSACleanup accept htonl listen ioctlsocket

usp10

ScriptShape ScriptItemize ScriptFreeCache

Name

.text

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

92KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

37B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

15.1MB

Virtual Size

15.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

231KB

Virtual Size

230KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=38, id=241, version=40116,

count=39, id=242, version=40116,

count=1, id=245, version=40116,

count=211, id=243, version=40116,

count=8, id=199, version=41118,

count=28, id=259, version=24123,

count=698, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=124, id=261, version=24123,

count=42, id=260, version=24123,

count=2, id=261, version=23013,

count=11, id=244, version=40116,

count=33, id=239, version=40116,

count=559, id=1, productName=Unmarked objects,

count=29, id=261, version=32535,

count=1, id=260, version=32535,

count=465, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=27, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,