2026-10-21_7cf95d37b9542bf55ce6bd67404ef68e_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-21_7cf95d37b9542bf55ce6bd67404ef68e_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil
Size 3.2MB
Sample261022-yy4e2ahx7p
SHA256 7d93b574cde96e671876db62e7b78ade3a1c2b1c783999477476e99af24b5492
MD5 7cf95d37b9542bf55ce6bd67404ef68e
SHA1 e9c3f1bacfdde83c2db6bc5189ff8792547b98fd
SHA512 73112eb4d90f73a7b90bc90d418719e5354c95203a65a7c921d9c2e602db43319bbd75c5e1fbe340985db49c6d2b766cd96df0c9cbadb34510dc1b411bed3311
SSDEEP 98304:oDNBpKnS5I3cahfmCWu7Jgw03dMtcIwuL:2wPZnC6
TLSH
T14BF5CF22B782C472E9D3017556BE9B7F4839EB201B35D0D3D7E419AC0D306D16B3AB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-21_7cf95d37b9542bf55ce6bd67404ef68e_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

File Explorer

2026-10-21_7cf95d37b9542bf55ce6bd67404ef68e_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

.exe 3.2MB

2026-10-21_7cf95d37b9542bf55ce6bd67404ef68e_coinminer_darkgate_elex_glassworm_graphican_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

IMPHASH 5c79fcb959e3ee6e6f05352d00b17ae0
SHA256 7d93b574cde96e671876db62e7b78ade3a1c2b1c783999477476e99af24b5492
MD5 7cf95d37b9542bf55ce6bd67404ef68e
SHA1 e9c3f1bacfdde83c2db6bc5189ff8792547b98fd
SHA512 73112eb4d90f73a7b90bc90d418719e5354c95203a65a7c921d9c2e602db43319bbd75c5e1fbe340985db49c6d2b766cd96df0c9cbadb34510dc1b411bed3311
SSDEEP 98304:oDNBpKnS5I3cahfmCWu7Jgw03dMtcIwuL:2wPZnC6
TLSH
T14BF5CF22B782C472E9D3017556BE9B7F4839EB201B35D0D3D7E419AC0D306D16B3AB9A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1565929

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\code_version\code_3.5.6.9\rel\PDFUtility.pdb

kernel32

GetNativeSystemInfo ResetEvent PostQueuedCompletionStatus GetExitCodeThread TerminateThread CreateIoCompletionPort InterlockedExchange GetQueuedCompletionStatus GetComputerNameW GetVersion GetSystemTime SystemTimeToFileTime CreateToolhelp32Snapshot Process32FirstW Process32NextW ReleaseMutex GetThreadLocale SetThreadLocale SetEndOfFile CreateDirectoryW WaitForMultipleObjects UnmapViewOfFile MapViewOfFile GetFileSizeEx RemoveDirectoryW GetLongPathNameW GetDriveTypeW InitializeCriticalSection OpenEventW OpenFileMappingW IsWow64Process GetCurrentProcessId CreateThread VirtualProtect lstrcmpA FlushFileBuffers SleepEx FormatMessageA GetFileType GetStdHandle PeekNamedPipe ExpandEnvironmentStringsA VerSetConditionMask VerifyVersionInfoW GetModuleHandleA QueryPerformanceCounter LoadLibraryA GlobalMemoryStatus FlushConsoleInputBuffer SystemTimeToTzSpecificLocalTime FileTimeToSystemTime FindClose FindNextFileW FindFirstFileW lstrlenW GetFileAttributesExW WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetVersionExW GetCurrentDirectoryW GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetACP SetConsoleMode ReadConsoleInputA GetConsoleMode SetConsoleCtrlHandler ExitProcess SetFilePointerEx GetModuleHandleExW ExitThread MoveFileExW SetFileAttributesW GetSystemDirectoryW WaitForSingleObject GetWindowsDirectoryW SetEvent LoadLibraryW TerminateProcess CopyFileW MoveFileW DeleteFileW GetFileSize GetCommandLineW CreateEventW LoadLibraryExW lstrcmpiW FreeLibrary GetCurrentProcess GetExitCodeProcess ReadFile GetStartupInfoW CreatePipe SetProcessShutdownParameters WriteFile SetFilePointer SetLastError GetCurrentThreadId CreateMutexW GetPrivateProfileStringW GetTickCount WritePrivateProfileStringW GetPrivateProfileIntW InterlockedIncrement InterlockedDecrement LeaveCriticalSection EnterCriticalSection GetModuleFileNameW Sleep OutputDebugStringW FindResourceExW FindResourceW LoadResource LockResource SizeofResource WideCharToMultiByte CreateProcessW LocalFree GetProcAddress CloseHandle MultiByteToWideChar OpenProcess CreateFileW LocalAlloc DeviceIoControl GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SwitchToThread SignalObjectAndWait CreateTimerQueue SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc GetCPInfo WaitForSingleObjectEx DuplicateHandle TryEnterCriticalSection GetStringTypeW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent GetCurrentThread SetThreadPriority GetLocaleInfoW GetFullPathNameW FormatMessageW GetSystemInfo OutputDebugStringA lstrlenA GetLastError HeapSize InitializeCriticalSectionAndSpinCount HeapFree SetStdHandle GetModuleHandleW

user32

LoadCursorW RegisterClassExW MessageBoxA GetUserObjectInformationW GetProcessWindowStation DefWindowProcW SetTimer GetMessageW TranslateMessage CharLowerBuffW PostQuitMessage KillTimer CharNextW CallWindowProcW CreateWindowExW PeekMessageW DispatchMessageW GetWindowLongW SetWindowLongW GetClassInfoExW wsprintfW DestroyWindow ShowWindow IsWindow FindWindowW UnregisterClassW SendMessageW PostMessageW

advapi32

ReportEventA RegisterEventSourceA CryptDecrypt CryptEncrypt CryptDeriveKey CryptHashData CryptReleaseContext CryptDestroyKey CryptDestroyHash CryptCreateHash CryptAcquireContextW RegEnumKeyW RegSetKeySecurity SetSecurityDescriptorDacl InitializeSecurityDescriptor SetSecurityInfo DeleteAce EqualSid GetAce GetSecurityInfo GetTokenInformation OpenProcessToken DeregisterEventSource DeleteService StartServiceW QueryServiceStatus RegEnumKeyExW RegQueryInfoKeyW CreateServiceW GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority RegDeleteValueW RegCloseKey CloseServiceHandle OpenSCManagerW RegDeleteKeyW RegCreateKeyExW ControlService RegSetValueExW RegOpenKeyExW ConvertSidToStringSidW QueryServiceConfigW OpenServiceW GetUserNameW RegQueryValueExW LookupAccountNameW ChangeServiceConfigW

shell32

SHGetFolderPathW ord165 ShellExecuteW ShellExecuteExW SHGetSpecialFolderPathW SHChangeNotify SHGetSpecialFolderLocation SHGetMalloc SHCreateDirectoryExW SHGetPathFromIDListW CommandLineToArgvW

ole32

CoInitialize CoUninitialize CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CLSIDFromProgID OleRun CoInitializeEx CoInitializeSecurity CoCreateGuid CoTaskMemFree

oleaut32

LoadRegTypeLi LoadTypeLi VarUI4FromStr SysAllocString SysStringLen GetErrorInfo VariantCopy VariantClear VariantInit SysFreeString

shlwapi

PathCanonicalizeW PathRemoveBackslashW PathIsPrefixW PathFindExtensionW AssocQueryStringW SHDeleteValueW PathSearchAndQualifyW StrStrIW PathIsDirectoryW SHGetValueW PathCombineW PathRemoveExtensionW PathFindFileNameW SHDeleteKeyW PathRemoveFileSpecW PathFileExistsW PathAppendW SHSetValueW

wininet

InternetReadFile HttpQueryInfoW InternetCloseHandle HttpSendRequestW HttpOpenRequestW InternetConnectW InternetSetOptionW InternetOpenW InternetCrackUrlW

ws2_32

bind send recv WSASetLastError select WSAStartup __WSAFDIsSet WSAGetLastError WSACleanup closesocket getpeername getsockname getservbyname htonl shutdown ioctlsocket sendto recvfrom listen accept freeaddrinfo getaddrinfo gethostbyname inet_ntoa gethostname WSAIoctl socket setsockopt ntohs htons getsockopt connect

crypt32

CryptStringToBinaryW CryptBinaryToStringW

netapi32

Netbios

wldap32

ord127 ord27 ord26 ord118 ord41 ord216 ord14 ord46 ord167 ord208 ord301 ord147 ord133 ord79 ord142 ord145

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

psapi

EnumProcessModules

iphlpapi

GetAdaptersInfo GetIpAddrTable

secur32

GetUserNameExW

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

529KB

Virtual Size

529KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

53KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

850KB

Virtual Size

852KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=21, id=241, version=40116,

count=203, id=243, version=40116,

count=31, id=242, version=40116,

count=6, id=199, version=41118,

count=27, id=259, version=24123,

count=132, id=261, version=24123,

count=39, id=260, version=24123,

count=3, id=261, version=23013,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=503, id=1, productName=Unmarked objects,

count=85, id=260, productName=VS2015 [14.0] build 23026, version=23026,

count=495, id=260, productName=VS2015 UPD2 build 23918, version=23918,

count=124, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=134, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,