7533f82236855f352e3fa9251ed632dc6387450fbecbc034d7ea431b8f7fb594

General

Target
2026-09-24_8319416ca3600be97508058b5b4c6890_coinminer_darkgate_elex_glassworm_hawkeye_luca-stealer_magniber_njrat_remcos_zxxz
Size 6.3MB
Sample260925-grf8gsbb38
SHA256 7533f82236855f352e3fa9251ed632dc6387450fbecbc034d7ea431b8f7fb594
MD5 8319416ca3600be97508058b5b4c6890
SHA1 02132d7f3916105292d411d3bcdc26aa411e6a37
SHA512 74e170d4522208a516f0e66cfff5325678da58b9d6a688cf3a01a381baa92e5aad50c0a54e52dc2da9e5daa70b23b0166b63691260ebf6d201c864fe464105b0
SSDEEP 98304:HAgLQGBBBWVE+kZmfhShAFaMueeu+O2vMgbkR7wqCr/:HAKzP+dVnH
TLSH
T1B666AE72B680F03DD2DEC071482BE61551B6ED74497089B7BF89BA2C3AF15C29239B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-24_8319416ca3600be97508058b5b4c6890_coinminer_darkgate_elex_glassworm_hawkeye_luca-stealer_magniber_njrat_remcos_zxxz
- Size 6.3MB
- SHA256 7533f82236855f352e3fa9251ed632dc6387450fbecbc034d7ea431b8f7fb594
- MD5 8319416ca3600be97508058b5b4c6890
- SHA1 02132d7f3916105292d411d3bcdc26aa411e6a37
- SHA512 74e170d4522208a516f0e66cfff5325678da58b9d6a688cf3a01a381baa92e5aad50c0a54e52dc2da9e5daa70b23b0166b63691260ebf6d201c864fe464105b0
- SSDEEP 98304:HAgLQGBBBWVE+kZmfhShAFaMueeu+O2vMgbkR7wqCr/:HAKzP+dVnH
- TLSH
  T1B666AE72B680F03DD2DEC071482BE61551B6ED74497089B7BF89BA2C3AF15C29239B17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution upx
- Detects JavaScript files used for persistence and executable or script execution
- UPX dump on OEP (original entry point)
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2