fb3e77172195f3475666084b23bb7053e9d104a0047308df33ac39c8fe3c87d7

General

Target
2026-10-19_42523883fcdd6295165b782188fa5beb_coinminer_darkgate_elex_glassworm_hawkeye_luca-stealer_magniber_njrat_remcos_zxxz
Size 6.3MB
Sample261020-18aa2sax2k
SHA256 fb3e77172195f3475666084b23bb7053e9d104a0047308df33ac39c8fe3c87d7
MD5 42523883fcdd6295165b782188fa5beb
SHA1 203b351caaed03be3ec6768c98b6970247564257
SHA512 4b2fbb58232b467240227d3ac90bf5bf359950860970a557586093eb181e80f89021b39793bd2320b4b702b5f2ce3b83ab6934b5efe9d8c230d23cc7425f23a4
SSDEEP 98304:+mvOCECt5o23Ya0aEcg4UkTAI1VuWJa/v0MgOG598dwDCrH:uJAlSaE6UkI++M
TLSH
T14766BF327680F03DD29ED071082BE65551FADD704A7589B7BF98BA2C3AF05C29639B13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-19_42523883fcdd6295165b782188fa5beb_coinminer_darkgate_elex_glassworm_hawkeye_luca-stealer_magniber_njrat_remcos_zxxz
- Size 6.3MB
- SHA256 fb3e77172195f3475666084b23bb7053e9d104a0047308df33ac39c8fe3c87d7
- MD5 42523883fcdd6295165b782188fa5beb
- SHA1 203b351caaed03be3ec6768c98b6970247564257
- SHA512 4b2fbb58232b467240227d3ac90bf5bf359950860970a557586093eb181e80f89021b39793bd2320b4b702b5f2ce3b83ab6934b5efe9d8c230d23cc7425f23a4
- SSDEEP 98304:+mvOCECt5o23Ya0aEcg4UkTAI1VuWJa/v0MgOG598dwDCrH:uJAlSaE6UkI++M
- TLSH
  T14766BF327680F03DD29ED071082BE65551FADD704A7589B7BF98BA2C3AF05C29639B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution upx
- Detects JavaScript files used for persistence and executable or script execution
- UPX dump on OEP (original entry point)
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2