General
- Target 2026-09-26_a9b55c5b9f1a6c773105eef07abc5f39_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz
- Size 6.0MB
- Sample260926-vgvvsafc55
- SHA256 8735e7934cc9780ad2d84fda1b45624d80d124e2f5c418a3be5a562fa6df936b
Score
10/10
Malware Config
Targets
-
- Target 2026-09-26_a9b55c5b9f1a6c773105eef07abc5f39_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz
- Size 6.0MB
- SHA256 8735e7934cc9780ad2d84fda1b45624d80d124e2f5c418a3be5a562fa6df936b
Score9/10-
Detects JavaScript files used for persistence and executable or script execution
-
UPX dump on OEP (original entry point)
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.