General
- Target 2026-09-26_73daec3db6a6f9825441f1aea923928b_coinminer_elex_glassworm_hawkeye_magniber_maze_remcos_stealc_zxxz
- Size 5.6MB
- Sample260926-zarxrss1es
- SHA256 657ad3deef9387716d8dffd406c989e394a83b5b2052afab35ccc0760ba485bd
Score
10/10
Malware Config
Targets
-
- Target 2026-09-26_73daec3db6a6f9825441f1aea923928b_coinminer_elex_glassworm_hawkeye_magniber_maze_remcos_stealc_zxxz
- Size 5.6MB
- SHA256 657ad3deef9387716d8dffd406c989e394a83b5b2052afab35ccc0760ba485bd
Score9/10-
Detects JavaScript files used for persistence and executable or script execution
-
UPX dump on OEP (original entry point)
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.