41e1a9fe262bad80748c5c32282cbfee285893bafe5ade0f9e4fe8ab187bafb3

General

Target
2026-10-19_87b2faa7a13bb9365268cf4c2456e956_coinminer_elex_glassworm_hawkeye_luca-stealer_magniber_njrat_remcos_zxxz
Size 5.7MB
Sample261020-rlw2vsbh48
SHA256 41e1a9fe262bad80748c5c32282cbfee285893bafe5ade0f9e4fe8ab187bafb3
MD5 87b2faa7a13bb9365268cf4c2456e956
SHA1 2340932fa6e5bc6e0c7d280cb2cd27cf52eb5c5b
SHA512 8b300e848c6b199b38eb56f434b5792022becd26e896270d6cc1b288478a429881bda5b412634590062b4278e3864e139c13c65750720c68d9285f32939055d7
SSDEEP 49152:YqBsyCQFDUAXhVqToXA1OCgjNmZ8Cnqlbcnw/o6gvfrX7W7Km2GagJFpBtFe2F/Q:LCQ5UAXGSC0NmqCI7f3l7F/hM0MgUa
TLSH
T19E56B012B6C0D03AE2D214714C2B675951F7ED604A708AB7B3CCBE2D3E749C2A53AB57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-19_87b2faa7a13bb9365268cf4c2456e956_coinminer_elex_glassworm_hawkeye_luca-stealer_magniber_njrat_remcos_zxxz
- Size 5.7MB
- SHA256 41e1a9fe262bad80748c5c32282cbfee285893bafe5ade0f9e4fe8ab187bafb3
- MD5 87b2faa7a13bb9365268cf4c2456e956
- SHA1 2340932fa6e5bc6e0c7d280cb2cd27cf52eb5c5b
- SHA512 8b300e848c6b199b38eb56f434b5792022becd26e896270d6cc1b288478a429881bda5b412634590062b4278e3864e139c13c65750720c68d9285f32939055d7
- SSDEEP 49152:YqBsyCQFDUAXhVqToXA1OCgjNmZ8Cnqlbcnw/o6gvfrX7W7Km2GagJFpBtFe2F/Q:LCQ5UAXGSC0NmqCI7f3l7F/hM0MgUa
- TLSH
  T19E56B012B6C0D03AE2D214714C2B675951F7ED604A708AB7B3CCBE2D3E749C2A53AB57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution upx
- Detects JavaScript files used for persistence and executable or script execution
- UPX dump on OEP (original entry point)
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2