General
- Target 2026-09-26_4e84ac9f00d0d3d23cbacbb36d9428b0_amadey_coinminer_darkgate_elex_glassworm_hawkeye_magniber_maze_remcos_smoke-loader_stealc_zxxz
- Size 6.3MB
- Sample260926-23frbatcjd
- SHA256 1c9fc02a92bf832a7251561489fe31eb93cea05e2fc9e5bdf70fa187a8022b77
Score
10/10
Malware Config
Targets
-
- Target 2026-09-26_4e84ac9f00d0d3d23cbacbb36d9428b0_amadey_coinminer_darkgate_elex_glassworm_hawkeye_magniber_maze_remcos_smoke-loader_stealc_zxxz
- Size 6.3MB
- SHA256 1c9fc02a92bf832a7251561489fe31eb93cea05e2fc9e5bdf70fa187a8022b77
Score9/10-
Detects JavaScript files used for persistence and executable or script execution
-
UPX dump on OEP (original entry point)
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.