2026-09-29_0b5de217433857fcceb52b2b0416b867_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_0b5de217433857fcceb52b2b0416b867_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_remcos_revil
Size 5.2MB
Sample260930-ges2hsfh64
SHA256 809b1cced81191977ed55ad9ee651a93637e4ae472daef04a36b77adabcda03a
MD5 0b5de217433857fcceb52b2b0416b867
SHA1 5a1de1bed8f1c59afb3d5ae566c44f1546fc1e20
SHA512 e3e59605d9a2fdb8875a06d434ae37328fafd53642e6a9058d467879d3b48199b73b3052a8f4b21982ac4f0e491af6fea4147094ce429a87cf27cb172fe05e4f
SSDEEP 98304:q4koQIXvjbNKdlxALrIY9Uq8KwfJ4kdA15V2:q4CY9L8KwfJ4N0
TLSH
T12346C0017E428472EB51027579FAA776DD7DBE1C0B2085C3AFAB36AD1E302D126F5386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_0b5de217433857fcceb52b2b0416b867_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_remcos_revil

File Explorer

2026-09-29_0b5de217433857fcceb52b2b0416b867_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_remcos_revil

.exe 5.2MB

2026-09-29_0b5de217433857fcceb52b2b0416b867_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_remcos_revil

IMPHASH bc73a1ed4c4bf4c3d3f9e9caab5f7fe5
SHA256 809b1cced81191977ed55ad9ee651a93637e4ae472daef04a36b77adabcda03a
MD5 0b5de217433857fcceb52b2b0416b867
SHA1 5a1de1bed8f1c59afb3d5ae566c44f1546fc1e20
SHA512 e3e59605d9a2fdb8875a06d434ae37328fafd53642e6a9058d467879d3b48199b73b3052a8f4b21982ac4f0e491af6fea4147094ce429a87cf27cb172fe05e4f
SSDEEP 98304:q4koQIXvjbNKdlxALrIY9Uq8KwfJ4kdA15V2:q4CY9L8KwfJ4N0
TLSH
T12346C0017E428472EB51027579FAA776DD7DBE1C0B2085C3AFAB36AD1E302D126F5386
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2082113

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\UGit\crash_report\bin\bugreport.pdb

ws2_32

htons setsockopt send recv WSAGetLastError connect WSACleanup WSAStartup ntohs getsockname getpeername WSASetLastError closesocket shutdown bind __WSAFDIsSet ioctlsocket freeaddrinfo inet_ntoa getservbyname gethostbyname getaddrinfo sendto recvfrom listen accept getsockopt ntohl socket gethostname WSAIoctl select htonl inet_addr

shell32

SHFileOperationW SHGetFileInfoW CommandLineToArgvW ExtractIconW SHGetSpecialFolderPathW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

psapi

GetProcessMemoryInfo

user32

GetDC MessageBoxA GetUserObjectInformationW GetProcessWindowStation UnregisterClassW GetGuiResources ReleaseDC

crypt32

CryptMsgClose CertCloseStore CertFreeCertificateContext CryptQueryObject CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW

advapi32

RegCloseKey RegOpenKeyExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegQueryValueExW DeregisterEventSource ReportEventA RegisterEventSourceA

wldap32

ord26 ord27 ord41 ord79 ord211 ord46 ord301 ord22 ord200 ord60 ord143 ord50 ord30 ord35 ord33 ord32

normaliz

IdnToAscii IdnToUnicode

gdi32

DeleteObject GetObjectA GetDIBits CreateCompatibleBitmap GetDeviceCaps

kernel32

FreeEnvironmentStringsW RtlCaptureStackBackTrace GenerateConsoleCtrlEvent GetEnvironmentStringsW SetFilePointer GetLocalTime GetCommandLineA GetOEMCP GetVersionExA IsValidCodePage Process32First FindFirstFileExA GetProcessHeap HeapSize CreatePipe GetExitCodeProcess FlushFileBuffers GetTimeZoneInformation SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW ReadConsoleW GetACP HeapReAlloc MoveFileExW GetCurrentDirectoryW GetCurrentDirectoryA Process32Next Module32First SetCurrentDirectoryW SetCurrentDirectoryA SetEnvironmentVariableW SetEnvironmentVariableA GetFullPathNameA GetFullPathNameW HeapFree HeapAlloc SetConsoleMode ReadConsoleInputA PeekConsoleInputA GetNumberOfConsoleInputEvents ResumeThread ExitThread ExitProcess SetConsoleCtrlHandler WriteConsoleW GetModuleFileNameA GetConsoleMode GetConsoleCP CreateProcessA GetDriveTypeW RtlUnwind WaitForMultipleObjectsEx CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle CreateDirectoryA CreateFileA DeleteFileA GetFileAttributesA SetProcessAffinityMask GetFileSize LockFile WideCharToMultiByte GetLastError InitializeCriticalSectionAndSpinCount LockFileEx CreateEventW CloseHandle EnterCriticalSection ResetEvent LeaveCriticalSection SetEvent WaitForSingleObject MultiByteToWideChar CreateFileW GetFileSizeEx FindFirstFileW GetFileTime FindNextFileW FindClose OpenProcess ReadProcessMemory LoadLibraryW GetProcAddress FreeLibrary GetProcessTimes FileTimeToSystemTime GetSystemTime GetFileAttributesW GetCurrentThreadId GetCommandLineW LocalAlloc LocalFree CreateThread GetCurrentProcess CopyFileW ReadFile WriteFile SystemTimeToFileTime CreateProcessW GetFileInformationByHandle CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId TerminateProcess DeleteFileW RemoveDirectoryW TerminateThread Sleep GetTickCount RaiseException DecodePointer OutputDebugStringA CreateDirectoryW WritePrivateProfileStringW GetModuleHandleExW GetModuleFileNameW GetTempPathW GetPrivateProfileStringW FormatMessageW GetFileAttributesExW GlobalAlloc GlobalFree GetModuleHandleW SystemTimeToTzSpecificLocalTime GetTempFileNameW TryEnterCriticalSection CreateMutexA ReleaseMutex OpenFileMappingW VirtualProtect GetSystemInfo CreateFileMappingW MapViewOfFile GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle InitializeCriticalSection GetTempPathA GetWindowsDirectoryA GetComputerNameA GetSystemTimeAsFileTime GetModuleHandleA GetFileType SetLastError FormatMessageA SleepEx VerifyVersionInfoA GetSystemDirectoryA LoadLibraryA VerSetConditionMask ExpandEnvironmentStringsA WaitForMultipleObjects PeekNamedPipe FindFirstFileA FindNextFileA GlobalMemoryStatus QueryPerformanceCounter FlushConsoleInputBuffer TzSpecificLocalTimeToSystemTime SetFileTime CopyFileA UnlockFileEx VirtualFree VirtualAlloc DeleteCriticalSection UnmapViewOfFile GetVersionExW IsDebuggerPresent OutputDebugStringW QueryPerformanceFrequency FindFirstFileExW GetDiskFreeSpaceExW SetEndOfFile SetFileAttributesW SetFilePointerEx CreateHardLinkW AreFileApisANSI GetStringTypeW TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead WaitForSingleObjectEx SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW UnlockFile

ole32

CoUninitialize CoCreateGuid CoInitialize CoCreateInstance

shlwapi

PathFileExistsW

iphlpapi

GetAdaptersInfo

winmm

timeBeginPeriod timeKillEvent timeGetDevCaps timeSetEvent

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

663KB

Virtual Size

662KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

293KB

Virtual Size

382KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

183KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=24, id=241, version=40116,

count=206, id=243, version=40116,

count=30, id=242, version=40116,

count=1, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=20, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=9, id=199, version=41118,

count=26, id=259, version=24237,

count=37, id=260, version=24237,

count=127, id=261, version=24237,

count=12, id=203, version=65501,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=261, version=24245,

count=324, id=1, productName=Unmarked objects,

count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=260, version=24245,

count=654, id=265, version=24245,

count=1, id=255, version=24245,

count=1, id=151,

count=1, id=258, version=24245,