9bce3abfdb112a08704ac5525038a229f3b9dd6bc464bcd68802c58b95683287

General

Target
2026-09-24_53f8f3fffbd63ca0272cfc3a1aa2926f_coinminer_darkgate_elex_glassworm_hawkeye_luca-stealer_magniber_njrat_remcos_zxxz
Size 6.0MB
Sample260925-lrcbraywcw
SHA256 9bce3abfdb112a08704ac5525038a229f3b9dd6bc464bcd68802c58b95683287
MD5 53f8f3fffbd63ca0272cfc3a1aa2926f
SHA1 dbdfa2be5b840ed2da6a31dd491606636ca264c5
SHA512 237fb29cd846426d2c536d9122798a47664517e857e8b54d7704a7d510cee54621c44ed9559d10794facd261debb5a53482d1bc5482907a5dd2e7e2d78cafd0d
SSDEEP 98304:xA+ICG8pwhI0ZPoL0Zzp/nWTuAfHFDg0XK2bGMqhFKZ:aiOZPoL0ZzSFC
TLSH
T1DB56B0137B819037D6D605704C2A677953F7EEA84A7085D7B39CBA2C3E70AC2953AB13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-24_53f8f3fffbd63ca0272cfc3a1aa2926f_coinminer_darkgate_elex_glassworm_hawkeye_luca-stealer_magniber_njrat_remcos_zxxz
- Size 6.0MB
- SHA256 9bce3abfdb112a08704ac5525038a229f3b9dd6bc464bcd68802c58b95683287
- MD5 53f8f3fffbd63ca0272cfc3a1aa2926f
- SHA1 dbdfa2be5b840ed2da6a31dd491606636ca264c5
- SHA512 237fb29cd846426d2c536d9122798a47664517e857e8b54d7704a7d510cee54621c44ed9559d10794facd261debb5a53482d1bc5482907a5dd2e7e2d78cafd0d
- SSDEEP 98304:xA+ICG8pwhI0ZPoL0Zzp/nWTuAfHFDg0XK2bGMqhFKZ:aiOZPoL0ZzSFC
- TLSH
  T1DB56B0137B819037D6D605704C2A677953F7EEA84A7085D7B39CBA2C3E70AC2953AB13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution upx
- Detects JavaScript files used for persistence and executable or script execution
- UPX dump on OEP (original entry point)
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2