2026-10-05_b3230686dd010f8bc145c8da11ac8abc_coinminer_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-05_b3230686dd010f8bc145c8da11ac8abc_coinminer_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil
Size 27.4MB
Sample261006-vbqnwassc1
SHA256 71ba2e10bc7171777cdc24b3906bf52f697c541f6b525435ac29ca002bc76f00
MD5 b3230686dd010f8bc145c8da11ac8abc
SHA1 041781c8803b4871899d1a16df762c50d0bf1719
SHA512 f2855e5df44b49088adb2824d8bd97461cbecbd2489cd95428173e6687844d74b9f75a8743c6bb1cbf2c66351be5939be6cd0e8ef8370a1c74734113f8904450
SSDEEP 786432:oRk53zU0rwqosjp8FZ10911Mo4XNJpIjeI95PZ:oREzU0rwhYeFL0911Mo4XNJpbU
TLSH
T1EF572312BA91C472D1930230996AB7BF5D7ABE300F34D1C7AB950A1D9E701D1B63B7E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-05_b3230686dd010f8bc145c8da11ac8abc_coinminer_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil

File Explorer

2026-10-05_b3230686dd010f8bc145c8da11ac8abc_coinminer_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil

.exe 27.4MB

2026-10-05_b3230686dd010f8bc145c8da11ac8abc_coinminer_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil

IMPHASH d473aec03b9f254e3ca201785926b730
SHA256 71ba2e10bc7171777cdc24b3906bf52f697c541f6b525435ac29ca002bc76f00
MD5 b3230686dd010f8bc145c8da11ac8abc
SHA1 041781c8803b4871899d1a16df762c50d0bf1719
SHA512 f2855e5df44b49088adb2824d8bd97461cbecbd2489cd95428173e6687844d74b9f75a8743c6bb1cbf2c66351be5939be6cd0e8ef8370a1c74734113f8904450
SSDEEP 786432:oRk53zU0rwqosjp8FZ10911Mo4XNJpIjeI95PZ:oREzU0rwhYeFL0911Mo4XNJpbU
TLSH
T1EF572312BA91C472D1930230996AB7BF5D7ABE300F34D1C7AB950A1D9E701D1B63B7E2
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1847982

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\System\sysreset\Trunk\App\Bundles\WanNengResetMaster\Temp\Release\Install.pdb

kernel32

GetPrivateProfileStringW WritePrivateProfileStringW InterlockedIncrement InterlockedDecrement SetCurrentDirectoryW GlobalAlloc GlobalLock GlobalUnlock FindClose ExpandEnvironmentStringsA FindFirstFileA FindNextFileA TerminateProcess MoveFileExW DeleteFileW GetFileAttributesExW CreateFileA GetWindowsDirectoryW GetTempPathW GetDriveTypeW GetEnvironmentVariableW CreateProcessW GetModuleFileNameW GetLogicalDriveStringsW lstrlenA CreateFileMappingW UnmapViewOfFile lstrlenW GetExitCodeProcess ReadFile GetDiskFreeSpaceExW GetModuleHandleW FormatMessageW GetSystemInfo GetCurrentThreadId LocalFree FindResourceW WriteFile SizeofResource LoadResource LockResource FreeResource GetTickCount CreateEventW MapViewOfFile GetFileSizeEx GetFileInformationByHandle InterlockedCompareExchange WaitForSingleObject SetEvent InitializeCriticalSection GetExitCodeThread TerminateThread WideCharToMultiByte DeleteCriticalSection InitializeCriticalSectionAndSpinCount RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy DecodePointer Sleep GetCurrentProcessId GetFileSize LeaveCriticalSection EnterCriticalSection FindFirstFileW CreateDirectoryW CreateThread MultiByteToWideChar GetVolumeInformationW GetSystemDirectoryW CreateMutexW ReleaseMutex LoadLibraryW GetProcAddress FreeLibrary GetVersionExW SetPriorityClass CreateFileW OutputDebugStringA WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FlushFileBuffers GetTimeZoneInformation SetStdHandle GetTimeFormatW CloseHandle DeviceIoControl GetLastError GetCurrentProcess GetDateFormatW GetConsoleCP GetACP SetConsoleCtrlHandler ExitProcess SetFilePointerEx FreeLibraryAndExitThread ExitThread QueryPerformanceFrequency FileTimeToSystemTime SystemTimeToTzSpecificLocalTime LoadLibraryExW RtlUnwind GetVersionExA GetLocalTime GetFullPathNameW HeapCreate FlushInstructionCache OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber GetModuleHandleExW VerifyVersionInfoA GetSystemDirectoryA EncodePointer SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetStringTypeW GetCPInfo MulDiv GetFileAttributesW SetFileTime SetFileAttributesW CompareFileTime FindNextFileW LocalFileTimeToFileTime VirtualAlloc VirtualFree FileTimeToDosDateTime DosDateTimeToFileTime FileTimeToLocalFileTime ResetEvent ReleaseSemaphore CreateSemaphoreW QueryPerformanceCounter WaitForMultipleObjects SetEndOfFile GetCurrentDirectoryW GetModuleHandleA FormatMessageA SleepEx GetFileType GetStdHandle PeekNamedPipe VerSetConditionMask LoadLibraryA

user32

FindWindowW SystemParametersInfoW IsWindow GetCursorPos SetWindowTextW ShowWindow PostQuitMessage PostMessageW SetWindowLongW GetWindowLongW SetForegroundWindow GetForegroundWindow SetWindowPos UnregisterClassW wsprintfW SendMessageW SetMenuContextHelpId GetMenuItemInfoW SetMenuInfo GetMenuInfo TrackPopupMenu AppendMenuW GetMenuItemCount GetDC ReleaseDC InflateRect OffsetRect DrawIconEx GetIconInfo CharUpperW CharPrevExA GetProcessWindowStation GetUserObjectInformationW MessageBoxW IntersectRect LoadCursorW DestroyCursor DestroyWindow SetTimer KillTimer SetCursor SetRect CopyRect UnionRect IsRectEmpty EqualRect PtInRect SetFocus GetFocus GetKeyState DefWindowProcW CallWindowProcW RegisterClassExW CreateWindowExW GetDlgItem GetActiveWindow GetClientRect GetWindowRect MapWindowPoints GetParent GetWindow MonitorFromWindow GetMonitorInfoW TrackMouseEvent AnimateWindow SetLayeredWindowAttributes IsIconic IsZoomed GetCapture SetCapture ReleaseCapture UpdateWindow BeginPaint EndPaint InvalidateRect CreateCaret GetCaretBlinkTime HideCaret SetCaretPos ScreenToClient GetClassNameW DestroyIcon GetMessageW TranslateMessage DispatchMessageW PeekMessageW IsWindowVisible MsgWaitForMultipleObjects IsWindowEnabled ClientToScreen LoadBitmapW CreateIconFromResource LoadImageW CharNextW EnableMenuItem GetSysColor GetSystemMetrics DrawTextW SystemParametersInfoA CharLowerBuffW MapVirtualKeyA UpdateLayeredWindow IsMenu CreatePopupMenu DestroyMenu

advapi32

CryptReleaseContext RegCloseKey RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegDeleteKeyW RegSetValueExW CryptGenRandom CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource

shell32

ShellExecuteW SHBrowseForFolderW SHCreateDirectoryExW SHGetSpecialFolderPathW SHFileOperationW SHGetPathFromIDListW

ole32

CoCreateGuid CreateStreamOnHGlobal OleUninitialize OleInitialize CoCreateInstance CoUninitialize CoInitialize OleLockRunning CLSIDFromString CLSIDFromProgID CreateBindCtx

shlwapi

StrToIntExW SHGetValueA PathFileExistsW SHCreateStreamOnFileEx

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdiplus

GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFileICM GdipCreateBitmapFromScan0 GdipImageSelectActiveFrame GdipBitmapUnlockBits GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectI GdipGraphicsClear GdipSaveImageToFile GdipDrawImageI GdipDeleteGraphics GdipBitmapLockBits GdipFree GdipAlloc GdipImageGetFrameCount GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList

imm32

ImmReleaseContext ImmAssociateContext ImmGetContext

wldap32

ord22 ord27 ord50 ord60 ord211 ord46 ord32 ord33 ord35 ord79 ord143 ord30 ord41 ord200 ord26 ord301

ws2_32

WSAGetLastError WSACleanup WSAStartup __WSAFDIsSet select recv send bind closesocket connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSAIoctl getaddrinfo freeaddrinfo recvfrom sendto accept listen ioctlsocket gethostname WSASetLastError

gdi32

CreateSolidBrush GetStockObject Rectangle CreateFontIndirectW StretchBlt SetGraphicsMode GetDeviceCaps CreateBitmap CreateRoundRectRgn SetTextColor EnumFontsW BitBlt GetViewportOrgEx GetCurrentObject SetViewportOrgEx GetObjectW CreateDIBSection SelectObject SelectClipRgn IntersectClipRect GetRegionData ExtCreateRegion DeleteObject DeleteDC CreateCompatibleDC SetWorldTransform ExtTextOutW GetTextFaceW SetBkMode EnumFontFamiliesExW GetCharABCWidthsW GetFontData GetGlyphOutlineW GetOutlineTextMetricsW GetFontUnicodeRanges GetGlyphIndicesW GetTextExtentPointI AddFontMemResourceEx RemoveFontMemResourceEx GetTextMetricsW SetTextAlign GdiFlush

oleaut32

SysAllocStringLen SysFreeString SysAllocString SysStringLen VariantCopy VariantClear

usp10

ScriptItemize ScriptShape ScriptFreeCache

Name

.text

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

924KB

Virtual Size

923KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

77KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

340B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27.7MB

Virtual Size

27.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

185KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=37, id=241, version=40116,

count=205, id=243, version=40116,

count=39, id=242, version=40116,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=261, version=23013,

count=8, id=199, version=41118,

count=28, id=259, version=24123,

count=6, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=2, id=259, productName=VS2015 UPD3 build 24210, version=24210,

count=704, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=549, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=62, id=261, version=24123,

count=39, id=260, version=24123,

count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=527, id=1, productName=Unmarked objects,

count=57, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,