2026-09-22_b94aa6d483933a8d6e1885bd20996d0d_coinminer_elex_glassworm_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-22_b94aa6d483933a8d6e1885bd20996d0d_coinminer_elex_glassworm_wannacry
Size 17.5MB
Sample260922-wdevtstz7n
SHA256 89cd19e60d98c877606b0f2fec7dd72457898360393df01ab48c0c97c61db225
MD5 b94aa6d483933a8d6e1885bd20996d0d
SHA1 b200264844ebe819101c188c7104ac61067a55e0
SHA512 e8157b081f90f4bfb5ab7bcbc880f332ab3db47bd87edd6200af0326061ba6e8bba1a8913486e04edc765d9648a63a58bdd90bf6b2d3ff59149502c930460c03
SSDEEP 393216:mBM6210OxOE8W82w7mSzUpv2R8fEY6v/sAGVnMWLct1Dzcauxbc9KyAYPahmKyw9:mBMdGOwEmvmSzUpv2R8fEJsAGVnMWLWM
TLSH
T15407D013FA858037FAE202B1A67E671F552C9F35032965C3F3887D49EAF22E16135693
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-22_b94aa6d483933a8d6e1885bd20996d0d_coinminer_elex_glassworm_wannacry

File Explorer

2026-09-22_b94aa6d483933a8d6e1885bd20996d0d_coinminer_elex_glassworm_wannacry

.exe 17.5MB

2026-09-22_b94aa6d483933a8d6e1885bd20996d0d_coinminer_elex_glassworm_wannacry

SHA256 89cd19e60d98c877606b0f2fec7dd72457898360393df01ab48c0c97c61db225
MD5 b94aa6d483933a8d6e1885bd20996d0d
SHA1 b200264844ebe819101c188c7104ac61067a55e0
SHA512 e8157b081f90f4bfb5ab7bcbc880f332ab3db47bd87edd6200af0326061ba6e8bba1a8913486e04edc765d9648a63a58bdd90bf6b2d3ff59149502c930460c03
SSDEEP 393216:mBM6210OxOE8W82w7mSzUpv2R8fEY6v/sAGVnMWLct1Dzcauxbc9KyAYPahmKyw9:mBMdGOwEmvmSzUpv2R8fEJsAGVnMWLWM
TLSH
T15407D013FA858037FAE202B1A67E671F552C9F35032965C3F3887D49EAF22E16135693
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4967651

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

12.3MB

Virtual Size

16.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1008KB

Virtual Size

1008KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

wnumgecr

Size

844KB

Virtual Size

844KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

jfsgvjtb

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.import

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=9, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=7, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=10, id=152, version=20115,

count=18, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=71, id=158, productName=VS2010 SP1 build 40219, version=40219,

count=8, id=171, productName=VS2010 build 30319, version=30319,

count=101, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=11, version=8966,

count=2, id=93, productName=VS2003 (.NET) build 3077, version=3077,

count=497, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=431, id=171, productName=VS2010 SP1 build 40219, version=40219,

count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=4, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=2, id=110, productName=VS2005 build 50727, version=50727,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=541, id=1, productName=Unmarked objects,

count=839, id=175, version=40219,

count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,