2026-09-25_e3b9aa240cd453cd7a843ad899cbbd1c_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_metamorfo_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-25_e3b9aa240cd453cd7a843ad899cbbd1c_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_metamorfo_njrat_remcos_revil
Size 4.4MB
Sample260925-wxezyage57
SHA256 9d85dbdc63df7d71429b1047ce94c7435d27a6203a245472fc7afed4324eb144
MD5 e3b9aa240cd453cd7a843ad899cbbd1c
SHA1 3204526ceb0cb060bc37053b1eabe00ffc422f3f
SHA512 25e8ba5beaacc1dfd800958e5e06166a6811ab6b390caf03eed6bcdfc1bf44b6b5f8845c292df2ef5b68f8a158dcce2110d87e55549700869899fac7499c1f75
SSDEEP 98304:JNlIB3RNBYGABDJNFOOd0TPmeRILdNfeRn/0Q:2B3RM4meOLb8nF
TLSH
T191267C31FE8B4C73D5910236446B76669AAFAE10072147C7A2D82BE96F301D13E3779E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-25_e3b9aa240cd453cd7a843ad899cbbd1c_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_metamorfo_njrat_remcos_revil

File Explorer

2026-09-25_e3b9aa240cd453cd7a843ad899cbbd1c_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_metamorfo_njrat_remcos_revil

.exe 4.4MB

2026-09-25_e3b9aa240cd453cd7a843ad899cbbd1c_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_metamorfo_njrat_remcos_revil

IMPHASH 045a65f1f51e960bb83add92db4198fa
SHA256 9d85dbdc63df7d71429b1047ce94c7435d27a6203a245472fc7afed4324eb144
MD5 e3b9aa240cd453cd7a843ad899cbbd1c
SHA1 3204526ceb0cb060bc37053b1eabe00ffc422f3f
SHA512 25e8ba5beaacc1dfd800958e5e06166a6811ab6b390caf03eed6bcdfc1bf44b6b5f8845c292df2ef5b68f8a158dcce2110d87e55549700869899fac7499c1f75
SSDEEP 98304:JNlIB3RNBYGABDJNFOOd0TPmeRILdNfeRn/0Q:2B3RM4meOLb8nF
TLSH
T191267C31FE8B4C73D5910236446B76669AAFAE10072147C7A2D82BE96F301D13E3779E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2058994

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Prog\CrashRptRail\bin\rail_crash_sender.pdb

kernel32

GetProcAddress FreeLibrary GetProcessTimes FileTimeToSystemTime GetSystemTime GetFileAttributesW GetCurrentThreadId GetCommandLineW CreateThread GetCurrentProcess ReadFile WriteFile CreateProcessW GetFileInformationByHandle CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId TerminateProcess DeleteFileW RemoveDirectoryW TerminateThread Sleep GetTickCount RaiseException DecodePointer OutputDebugStringA CreateDirectoryW WritePrivateProfileStringW GetModuleHandleExW GetModuleFileNameW GetTempPathW GetPrivateProfileStringW FormatMessageW GetFileAttributesExW GlobalAlloc GlobalFree SystemTimeToFileTime GetModuleHandleW SystemTimeToTzSpecificLocalTime GetTempFileNameW TryEnterCriticalSection CreateMutexA ReleaseMutex OpenFileMappingW UnmapViewOfFile GetSystemInfo CreateFileMappingW MapViewOfFile SetConsoleCtrlHandler WriteConsoleW GetModuleFileNameA GetConsoleMode GetConsoleCP CreateProcessA GetDriveTypeW RtlUnwind WaitForMultipleObjectsEx TzSpecificLocalTimeToSystemTime SetFileTime CopyFileA UnlockFileEx LoadLibraryW ReadProcessMemory OpenProcess FindClose FindNextFileW GetFileTime FindFirstFileW GetFileSizeEx CreateFileW MultiByteToWideChar UnlockFile LockFileEx LockFile GetFileSize GetFileAttributesA DeleteFileA CreateFileA CreateDirectoryA CreateTimerQueue UnregisterWaitEx WaitForSingleObject QueryDepthSList InterlockedFlushSList SetEvent InterlockedPushEntrySList LeaveCriticalSection Module32First Process32Next Process32First GetVersionExA GetLocalTime SetFilePointer GenerateConsoleCtrlEvent RtlCaptureStackBackTrace FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA GetProcessHeap HeapSize CreatePipe GetExitCodeProcess FlushFileBuffers GetTimeZoneInformation SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW ReadConsoleW GetACP HeapReAlloc MoveFileExW GetCurrentDirectoryW GetCurrentDirectoryA SetCurrentDirectoryW SetCurrentDirectoryA SetEnvironmentVariableW SetEnvironmentVariableA GetFullPathNameA GetFullPathNameW HeapFree HeapAlloc SetConsoleMode InterlockedPopEntrySList ReleaseSemaphore ReadConsoleInputA PeekConsoleInputA DuplicateHandle GetNumberOfConsoleInputEvents ResumeThread ExitThread SetProcessAffinityMask ResetEvent EnterCriticalSection CloseHandle CreateEventW VirtualProtect DeleteCriticalSection InitializeCriticalSectionAndSpinCount VirtualFree VirtualAlloc GetLastError WideCharToMultiByte GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle InitializeCriticalSection GetTempPathA GetWindowsDirectoryA GetComputerNameA GetSystemTimeAsFileTime GetModuleHandleA GetFileType SetLastError FormatMessageA SleepEx VerifyVersionInfoA GetSystemDirectoryA LoadLibraryA VerSetConditionMask ExpandEnvironmentStringsA WaitForMultipleObjects PeekNamedPipe FindFirstFileA FindNextFileA GlobalMemoryStatus QueryPerformanceCounter FlushConsoleInputBuffer IsDebuggerPresent OutputDebugStringW QueryPerformanceFrequency FindFirstFileExW GetDiskFreeSpaceExW SetEndOfFile SetFileAttributesW SetFilePointerEx CopyFileW CreateHardLinkW AreFileApisANSI GetStringTypeW TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead WaitForSingleObjectEx SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW GetVersionExW ExitProcess

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxA UnregisterClassW GetGuiResources ReleaseDC GetDC

shell32

SHGetFileInfoW ExtractIconW CommandLineToArgvW SHGetSpecialFolderPathW SHFileOperationW

ole32

CoCreateGuid CoInitialize CoCreateInstance CoUninitialize

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegQueryInfoKeyW RegEnumKeyExW RegEnumValueW RegCloseKey RegQueryValueExW DeregisterEventSource ReportEventA RegisterEventSourceA OpenProcessToken

ws2_32

freeaddrinfo sendto __WSAFDIsSet bind WSAIoctl closesocket WSASetLastError getpeername getsockname socket ntohs connect inet_addr listen accept getaddrinfo recvfrom gethostname getsockopt htons setsockopt send recv WSAGetLastError WSACleanup WSAStartup shutdown getservbyname ioctlsocket gethostbyname select htonl ntohl inet_ntoa

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

psapi

GetProcessMemoryInfo

wldap32

ord143 ord60 ord41 ord33 ord79 ord200 ord27 ord26 ord46 ord22 ord301 ord211 ord35 ord30 ord50 ord32

normaliz

IdnToAscii IdnToUnicode

gdi32

DeleteObject GetDeviceCaps GetDIBits CreateCompatibleBitmap GetObjectA

shlwapi

PathFileExistsW

iphlpapi

GetAdaptersInfo

winmm

timeGetDevCaps timeKillEvent timeSetEvent timeBeginPeriod

generic

count=24, id=241, version=40116,

count=206, id=243, version=40116,

count=30, id=242, version=40116,

count=1, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=20, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=9, id=199, version=41118,

count=26, id=259, version=24123,

count=125, id=261, version=24123,

count=37, id=260, version=24123,

count=2, id=261, version=23013,

count=6, id=203, version=65501,

count=4, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=2, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=315, id=1, productName=Unmarked objects,

count=654, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,