General
- Target 2026-09-26_bf81f267f1b0721375977273d2f9563f_coinminer_darkgate_elex_glassworm_hawkeye_luca-stealer_magniber_njrat_remcos_zxxz
- Size 6.0MB
- Sample260926-s2nwvsxtds
- SHA256 eebd2fa62816e7ab6d11a59fec6c11aaf01d82595e694a9b1aa31d2d07056873
Score
10/10
Malware Config
Targets
-
- Target 2026-09-26_bf81f267f1b0721375977273d2f9563f_coinminer_darkgate_elex_glassworm_hawkeye_luca-stealer_magniber_njrat_remcos_zxxz
- Size 6.0MB
- SHA256 eebd2fa62816e7ab6d11a59fec6c11aaf01d82595e694a9b1aa31d2d07056873
Score9/10-
Detects JavaScript files used for persistence and executable or script execution
-
UPX dump on OEP (original entry point)
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.