General
- Target 2026-10-13_30d203d5eadb40e865ad060583042706_coinminer_darkgate_elex_glassworm_hawkeye_magniber_maze_remcos_stealc_zxxz
- Size 5.3MB
- Sample261015-t7bddsav2m
- SHA256 1ca070fdd28c1a1ca64a2d2c5deb049e107f362cac6f266c804a1d93c8cc4d7b
Score
10/10
Malware Config
Targets
-
- Target 2026-10-13_30d203d5eadb40e865ad060583042706_coinminer_darkgate_elex_glassworm_hawkeye_magniber_maze_remcos_stealc_zxxz
- Size 5.3MB
- SHA256 1ca070fdd28c1a1ca64a2d2c5deb049e107f362cac6f266c804a1d93c8cc4d7b
Score9/10-
Detects JavaScript files used for persistence and executable or script execution
-
UPX dump on OEP (original entry point)
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.