2026-10-13_30d203d5eadb40e865ad060583042706_coinminer_darkgate_elex_glassworm_hawkeye_magniber_maze_remcos_stealc_zxxz

General

Target
2026-10-13_30d203d5eadb40e865ad060583042706_coinminer_darkgate_elex_glassworm_hawkeye_magniber_maze_remcos_stealc_zxxz
Size 5.3MB
Sample261015-t7bddsav2m
SHA256 1ca070fdd28c1a1ca64a2d2c5deb049e107f362cac6f266c804a1d93c8cc4d7b
MD5 30d203d5eadb40e865ad060583042706
SHA1 5125387c9dc9ece5b46c7b3a873ed4d180deb61c
SHA512 cd2adbf60e8eced3f71727b14ec0205b3ca6417ec48ea42f76703b460f72bc63b66c2d572be121d7051726b9176af79e6a8f04b0afc372c7ab2252ee0b52d3ae
SSDEEP 49152:qzCgTGg9w++tJ+8c4PVRs88R56GyKk4daDMwaECdPoz/EwMghW5HhrP19UsGJ:qzLlRq483jM5SD4dawutZMgm1
TLSH
T1E8469D72B681F07DD6EEC071082BD6099277AD7456308AB7BF987E2979F01C1923A743
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-13_30d203d5eadb40e865ad060583042706_coinminer_darkgate_elex_glassworm_hawkeye_magniber_maze_remcos_stealc_zxxz

File Explorer

2026-10-13_30d203d5eadb40e865ad060583042706_coinminer_darkgate_elex_glassworm_hawkeye_magniber_maze_remcos_stealc_zxxz

.exe 5.3MB

2026-10-13_30d203d5eadb40e865ad060583042706_coinminer_darkgate_elex_glassworm_hawkeye_magniber_maze_remcos_stealc_zxxz

SHA256 1ca070fdd28c1a1ca64a2d2c5deb049e107f362cac6f266c804a1d93c8cc4d7b
MD5 30d203d5eadb40e865ad060583042706
SHA1 5125387c9dc9ece5b46c7b3a873ed4d180deb61c
SHA512 cd2adbf60e8eced3f71727b14ec0205b3ca6417ec48ea42f76703b460f72bc63b66c2d572be121d7051726b9176af79e6a8f04b0afc372c7ab2252ee0b52d3ae
SSDEEP 49152:qzCgTGg9w++tJ+8c4PVRs88R56GyKk4daDMwaECdPoz/EwMghW5HhrP19UsGJ:qzLlRq483jM5SD4dawutZMgm1
TLSH
T1E8469D72B681F07DD6EEC071082BD6099277AD7456308AB7BF987E2979F01C1923A743
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

1983818

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

generic

count=2, id=225, version=20806,

count=5, id=199, version=41118,

count=46, id=223, productName=VS2013 build 21005, version=21005,

count=90, id=225, productName=VS2013 build 21005, version=21005,

count=290, id=224, productName=VS2013 build 21005, version=21005,

count=4, id=14, version=7299,

count=203, id=224, productName=VS2013 UPD3 build 30723, version=30723,

count=35, id=229, version=30723,

count=17, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=695, id=1, productName=Unmarked objects,

count=364, id=225, productName=VS2013 UPD3 build 30723, version=30723,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=3, id=151,

count=1, id=222, productName=VS2013 UPD3 build 30723, version=30723,

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_30d203d5eadb40e865ad060583042706_coinminer_darkgate_elex_glassworm_hawkeye_magniber_maze_remcos_stealc_zxxz

generic