General
- Target 2026-09-24_66b3f1a263dbd5adfba539397b4a2d07_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz
- Size 6.0MB
- Sample260925-j4c3pstamd
- SHA256 c2ba3ac0d858135ff80caa65eb3db6e0368c65984846683196929f37c5bf9de7
Score
10/10
Malware Config
Targets
-
- Target 2026-09-24_66b3f1a263dbd5adfba539397b4a2d07_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz
- Size 6.0MB
- SHA256 c2ba3ac0d858135ff80caa65eb3db6e0368c65984846683196929f37c5bf9de7
Score9/10-
Detects JavaScript files used for persistence and executable or script execution
-
UPX dump on OEP (original entry point)
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.