2026-10-26_e1cc5e1b6b47ed5ec01993d61c311325_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_e1cc5e1b6b47ed5ec01993d61c311325_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos
Size 3.2MB
Sample261027-e7phpays8l
SHA256 9b62a2028c5da8da0f1d75e1d5ca5f9fba11632d156e8502d5eea468a0784396
MD5 e1cc5e1b6b47ed5ec01993d61c311325
SHA1 6d00f8c0efbf8fc2ffd01b7b802c5f07a60f7300
SHA512 94cdb3a09a340a5cde0a328bba3f005d8706466699c68f8cc0aff3e22b83eb0afe3d8a69f26ccba32fb9ddb21e092e50c0059c30ec15c70d4a6cd4693c5ebcf0
SSDEEP 49152:NczU1vp0LMpojPsTN/9vi3/OuMLbBhWkOhBMIeTU8hfP4MxqW96Aq+gAScIb7N:Nb1PCmus1hWkKjOhoMx/IL
TLSH
T1A7F5AE11B681C432E9A301F14919ABFF447AFE202B6181C3B7BD7A5E4B705C2DE3A756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_e1cc5e1b6b47ed5ec01993d61c311325_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-10-26_e1cc5e1b6b47ed5ec01993d61c311325_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

.exe 3.2MB

2026-10-26_e1cc5e1b6b47ed5ec01993d61c311325_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

IMPHASH 05ff7cfb9e67518417d45a0be7e73762
SHA256 9b62a2028c5da8da0f1d75e1d5ca5f9fba11632d156e8502d5eea468a0784396
MD5 e1cc5e1b6b47ed5ec01993d61c311325
SHA1 6d00f8c0efbf8fc2ffd01b7b802c5f07a60f7300
SHA512 94cdb3a09a340a5cde0a328bba3f005d8706466699c68f8cc0aff3e22b83eb0afe3d8a69f26ccba32fb9ddb21e092e50c0059c30ec15c70d4a6cd4693c5ebcf0
SSDEEP 49152:NczU1vp0LMpojPsTN/9vi3/OuMLbBhWkOhBMIeTU8hfP4MxqW96Aq+gAScIb7N:Nb1PCmus1hWkKjOhoMx/IL
TLSH
T1A7F5AE11B681C432E9A301F14919ABFF447AFE202B6181C3B7BD7A5E4B705C2DE3A756
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

704840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\baidu\netdisk\pc-yunbrowser\output\AutoUpdate\output\pdb\Autoupdate.pdb

kernel32

FileTimeToSystemTime FlushFileBuffers GetFileInformationByHandle GetLogicalDrives GetVolumeInformationW DuplicateHandle GetExitCodeThread CreateFileMappingW MapViewOfFile UnmapViewOfFile RemoveDirectoryW GetTempFileNameW SetFilePointerEx SetFileTime Sleep TlsAlloc TlsFree TlsSetValue TlsGetValue GetPrivateProfileStringW GetModuleHandleW GetTickCount FreeLibrary GetProcAddress LoadLibraryW WriteFile CreateDirectoryW ReadFile GetFileSize WaitForSingleObject DeleteFileW SetLastError RaiseException LeaveCriticalSection EnterCriticalSection GetCurrentThreadId GetModuleFileNameW ReadDirectoryChangesW SetConsoleCtrlHandler SetEndOfFile EncodePointer OutputDebugStringW AllocConsole GetStdHandle GetConsoleScreenBufferInfo FreeConsole SetConsoleTextAttribute WriteConsoleW InitializeCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount CloseHandle Module32NextW CreateFileW GetLastError MultiByteToWideChar GetVolumeInformationA FindResourceExW FindResourceW LoadResource LockResource SizeofResource WideCharToMultiByte GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize GetPrivateProfileIntW GetCurrentProcessId CreateMutexW ReleaseMutex VerSetConditionMask VerifyVersionInfoW SetThreadPriority TerminateThread WaitForMultipleObjects Process32NextW Process32FirstW CreateToolhelp32Snapshot LoadLibraryA SetFilePointer GetFileAttributesW GetTempPathW GetCurrentProcess FindClose FindNextFileW FindFirstFileW OpenEventW ResetEvent ExitProcess GetCommandLineW OpenProcess DecodePointer LoadLibraryExW lstrcmpiW GetPrivateProfileSectionW GetSystemTime SystemTimeToFileTime WritePrivateProfileStringW MoveFileW SetEvent CreateEventW GetVersionExW CopyFileW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindNextFileA DeviceIoControl Module32FirstW FindFirstFileExA GetOEMCP IsValidCodePage GetTimeZoneInformation SetStdHandle GetFullPathNameW GetCurrentDirectoryW GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetModuleFileNameA GetACP SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW FreeLibraryAndExitThread ExitThread CreateThread GetFileAttributesExW RtlUnwind GetModuleHandleA GlobalUnlock GlobalLock GlobalAlloc lstrlenW FreeResource MulDiv HeapCreate MoveFileExW FormatMessageW LocalFree ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetEnvironmentVariableW ConvertFiberToThread DeleteFiber GetFileType GetModuleHandleExW QueryPerformanceCounter HeapDestroy GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetStringTypeW IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA GetSystemTimeAsFileTime

user32

RegisterClassExW UnregisterClassW DestroyWindow IsWindow KillTimer SetTimer CharLowerBuffW PostThreadMessageW MessageBoxW PostMessageW PostQuitMessage GetMessageW PeekMessageW SetForegroundWindow SetWindowPos AttachThreadInput GetWindowThreadProcessId GetProcessWindowStation GetUserObjectInformationW GetDlgItem GetParent TrackMouseEvent AnimateWindow UpdateLayeredWindow PrintWindow SetLayeredWindowAttributes MoveWindow IsWindowVisible IsIconic IsWindowEnabled SetFocus GetActiveWindow SetCapture ReleaseCapture EnableWindow GetSystemMetrics EndMenu UpdateWindow SetActiveWindow GetDC ReleaseDC CharNextW EndPaint InvalidateRect GetClientRect GetWindowRect GetCursorPos CreateCaret GetCaretBlinkTime SetCaretPos ClientToScreen ScreenToClient MapWindowPoints CopyRect InflateRect IntersectRect IsRectEmpty GetDesktopWindow EnumChildWindows GetWindow MonitorFromWindow GetMonitorInfoW GetKeyState SetCursor PtInRect EqualRect LoadBitmapW LoadImageW DrawTextW OffsetRect DestroyIcon DrawIconEx FillRect SetRect MapVirtualKeyA DefWindowProcW GetSysColor FindWindowExW UnionRect SetRectEmpty OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard MessageBeep CreatePopupMenu DestroyMenu AppendMenuW TrackPopupMenu GetMenuItemInfoW GetForegroundWindow ShowWindow SendMessageW LoadIconW SetWindowTextW CallWindowProcW GetWindowLongW SetWindowLongW CreateWindowExW LoadCursorW GetClassInfoExW DispatchMessageW BeginPaint TranslateMessage IsZoomed EnableMenuItem

gdi32

DeleteDC CreateBitmap GetTextMetricsW BitBlt CombineRgn CreateCompatibleBitmap CreateCompatibleDC CreateRectRgnIndirect GetCurrentObject GetObjectType GetRgnBox SelectClipRgn SelectObject SetBkColor SetBkMode StretchBlt SetTextColor GetObjectW ExtTextOutW SetViewportOrgEx CreatePen CreateRectRgn ExcludeClipRect GetClipRgn RectInRegion Rectangle RestoreDC SaveDC ExtSelectClipRgn OffsetViewportOrgEx AddFontMemResourceEx RemoveFontMemResourceEx GetTextExtentPointW GetTextExtentPoint32W GetDeviceCaps CreateFontIndirectW GetObjectA CreateSolidBrush GetStockObject DeleteObject GetTextColor GetViewportOrgEx LineTo RoundRect CreateDIBSection ExtCreatePen MoveToEx TextOutW GetClipBox CreateDIBitmap

advapi32

CryptExportKey CreateProcessAsUserW AdjustTokenPrivileges LookupPrivilegeValueW CheckTokenMembership CreateWellKnownSid GetTokenInformation DuplicateTokenEx OpenProcessToken RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegCloseKey RegQueryValueExA RegOpenKeyExA DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptEnumProvidersW CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW RegQueryValueExW

shell32

SHGetFolderPathW CommandLineToArgvW ord680 ShellExecuteExW ShellExecuteW SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal OleLockRunning CLSIDFromProgID CoCreateInstance CoTaskMemFree CoCreateGuid StringFromCLSID CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CoInitializeEx CLSIDFromString CoLoadLibrary StringFromGUID2 StgCreateStorageEx StgOpenStorageEx CreateBindCtx

oleaut32

SysFreeString SysAllocString VariantClear GetErrorInfo SysStringLen VarBstrCmp SysAllocStringByteLen SysStringByteLen VariantInit LoadRegTypeLi LoadTypeLi VarUI4FromStr VariantCopy SafeArrayCreate SafeArrayGetUBound SysAllocStringLen SafeArrayGetLBound SafeArrayLock SafeArrayUnlock VarCmp

shlwapi

StrToIntExA StrToIntW

iphlpapi

GetAdaptersAddresses

wininet

HttpEndRequestA InternetOpenA InternetSetOptionA InternetConnectA HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestExA HttpQueryInfoW HttpEndRequestW HttpSendRequestW HttpAddRequestHeadersW HttpOpenRequestW InternetSetStatusCallbackW InternetSetOptionW InternetWriteFile HttpQueryInfoA InternetQueryDataAvailable InternetReadFile InternetCloseHandle InternetConnectW InternetReadFileExA InternetQueryOptionA

setupapi

SetupIterateCabinetW SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces

bcrypt

BCryptGenRandom

imm32

ImmReleaseContext ImmGetContext

dwmapi

DwmGetWindowAttribute

gdiplus

GdipCreateTexture2I GdipDeleteBrush GdipCloneBrush GdipGetImageHeight GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipLoadImageFromStream GdipCreateFromHDC GdipDeleteGraphics GdipFillRectangleI GdipDrawImageRectRectI GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipDisposeImage GdipCloneImage GdipLoadImageFromFileICM GdipLoadImageFromStreamICM GdipSetImageAttributesWrapMode GdipLoadImageFromFile GdipGetImageWidth

msimg32

GradientFill AlphaBlend

ws2_32

closesocket WSAGetLastError WSACleanup recv send WSASetLastError

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

787KB

Virtual Size

787KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

49KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

270KB

Virtual Size

270KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

194KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_e1cc5e1b6b47ed5ec01993d61c311325_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

iphlpapi

wininet

setupapi

bcrypt

imm32

dwmapi

gdiplus

msimg32

ws2_32

crypt32

generic