2026-11-01_ea132eb500692316f247198e59a17e0b_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_ea132eb500692316f247198e59a17e0b_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_remcos_revil
Size 4.6MB
Sample261102-e7a1asg19n
SHA256 cc249953f1c4fcf1c59a5b31b5957adeea6294424d368824219642334e3a4cd1
MD5 ea132eb500692316f247198e59a17e0b
SHA1 abe9cafb96d6ff50ef2e0fb00f07b708903eee9a
SHA512 b5b94322449325e0c428e311ab6b85cc48344d2b1d4d0b633a2125cd48cac2c288fe87a6dc5ca9c5450d8d7b92b9cd0bbcac9d15cec8a2d780438d805b254a16
SSDEEP 49152:E1JtQfUZ53MQD7typ+VeQWwbM7FDC/OxKyzKC8aJBVE2+ofHTr8u3lpiyKg/w/1n:ckCtD7tNIKyuC53+2+ofh/w3mlYA0B
TLSH
T1A026BF11BE418472D751023178F6626ADDBDBE1C0B2046D3AF9B3BAD1E703D16AFA346
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_ea132eb500692316f247198e59a17e0b_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_remcos_revil

File Explorer

2026-11-01_ea132eb500692316f247198e59a17e0b_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_remcos_revil

.exe 4.6MB

2026-11-01_ea132eb500692316f247198e59a17e0b_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_njrat_remcos_revil

IMPHASH 52d6367a47f23e19cf705f3c443a048b
SHA256 cc249953f1c4fcf1c59a5b31b5957adeea6294424d368824219642334e3a4cd1
MD5 ea132eb500692316f247198e59a17e0b
SHA1 abe9cafb96d6ff50ef2e0fb00f07b708903eee9a
SHA512 b5b94322449325e0c428e311ab6b85cc48344d2b1d4d0b633a2125cd48cac2c288fe87a6dc5ca9c5450d8d7b92b9cd0bbcac9d15cec8a2d780438d805b254a16
SSDEEP 49152:E1JtQfUZ53MQD7typ+VeQWwbM7FDC/OxKyzKC8aJBVE2+ofHTr8u3lpiyKg/w/1n:ckCtD7tNIKyuC53+2+ofh/w3mlYA0B
TLSH
T1A026BF11BE418472D751023178F6626ADDBDBE1C0B2046D3AF9B3BAD1E703D16AFA346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2075525

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\UGit\crash_report\bin\rail_crash_sender.pdb

ws2_32

htons setsockopt send recv WSAGetLastError connect WSACleanup WSAStartup ntohs getsockname getpeername WSASetLastError closesocket shutdown bind __WSAFDIsSet ioctlsocket freeaddrinfo inet_ntoa getservbyname gethostbyname getaddrinfo sendto recvfrom listen accept getsockopt ntohl socket gethostname WSAIoctl select htonl inet_addr

shell32

SHFileOperationW SHGetFileInfoW CommandLineToArgvW ExtractIconW SHGetSpecialFolderPathW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

psapi

GetProcessMemoryInfo

user32

GetDC MessageBoxA GetUserObjectInformationW GetProcessWindowStation UnregisterClassW GetGuiResources ReleaseDC

advapi32

ReportEventA AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegQueryInfoKeyW RegEnumKeyExW RegEnumValueW RegCloseKey DeregisterEventSource RegOpenKeyExW RegisterEventSourceA RegQueryValueExW

wldap32

ord26 ord27 ord41 ord79 ord211 ord46 ord301 ord22 ord200 ord60 ord143 ord50 ord30 ord35 ord33 ord32

normaliz

IdnToAscii IdnToUnicode

gdi32

DeleteObject GetDeviceCaps GetDIBits CreateCompatibleBitmap GetObjectA

kernel32

FreeEnvironmentStringsW RtlCaptureStackBackTrace GenerateConsoleCtrlEvent SetFilePointer GetEnvironmentStringsW GetLocalTime GetVersionExA GetCommandLineA GetOEMCP Process32First IsValidCodePage Process32Next FindFirstFileExA GetProcessHeap HeapSize CreatePipe GetExitCodeProcess FlushFileBuffers GetTimeZoneInformation SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW ReadConsoleW GetACP HeapReAlloc MoveFileExW GetCurrentDirectoryW GetCurrentDirectoryA Module32First SetCurrentDirectoryW SetCurrentDirectoryA SetEnvironmentVariableW SetEnvironmentVariableA GetFullPathNameA GetFullPathNameW HeapFree HeapAlloc SetConsoleMode ReadConsoleInputA PeekConsoleInputA GetNumberOfConsoleInputEvents ResumeThread ExitThread ExitProcess SetConsoleCtrlHandler WriteConsoleW GetModuleFileNameA GetConsoleMode GetConsoleCP CreateProcessA GetDriveTypeW RtlUnwind WaitForMultipleObjectsEx CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle CreateDirectoryA CreateFileA DeleteFileA GetFileAttributesA SetProcessAffinityMask GetFileSize LockFile WideCharToMultiByte GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection CreateEventW CloseHandle LockFileEx ResetEvent LeaveCriticalSection SetEvent WaitForSingleObject MultiByteToWideChar CreateFileW GetFileSizeEx FindFirstFileW GetFileTime FindNextFileW FindClose OpenProcess ReadProcessMemory LoadLibraryW GetProcAddress FreeLibrary GetProcessTimes FileTimeToSystemTime GetSystemTime GetFileAttributesW GetCurrentThreadId GetCommandLineW CreateThread GetCurrentProcess CopyFileW ReadFile WriteFile SystemTimeToFileTime CreateProcessW GetFileInformationByHandle CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId TerminateProcess DeleteFileW RemoveDirectoryW TerminateThread Sleep GetTickCount RaiseException DecodePointer OutputDebugStringA CreateDirectoryW WritePrivateProfileStringW GetModuleHandleExW GetModuleFileNameW GetTempPathW GetPrivateProfileStringW FormatMessageW GetFileAttributesExW GlobalAlloc GlobalFree GetModuleHandleW SystemTimeToTzSpecificLocalTime GetTempFileNameW TryEnterCriticalSection CreateMutexA ReleaseMutex OpenFileMappingW UnmapViewOfFile GetSystemInfo CreateFileMappingW MapViewOfFile GetConsoleScreenBufferInfo VirtualProtect GetStdHandle InitializeCriticalSection GetTempPathA GetWindowsDirectoryA GetComputerNameA GetSystemTimeAsFileTime GetModuleHandleA GetFileType SetLastError FormatMessageA SleepEx VerifyVersionInfoA GetSystemDirectoryA LoadLibraryA VerSetConditionMask ExpandEnvironmentStringsA WaitForMultipleObjects PeekNamedPipe FindFirstFileA FindNextFileA GlobalMemoryStatus QueryPerformanceCounter FlushConsoleInputBuffer TzSpecificLocalTimeToSystemTime SetFileTime CopyFileA UnlockFileEx VirtualFree VirtualAlloc EnterCriticalSection SetConsoleTextAttribute GetVersionExW IsDebuggerPresent OutputDebugStringW QueryPerformanceFrequency FindFirstFileExW GetDiskFreeSpaceExW SetEndOfFile SetFileAttributesW SetFilePointerEx CreateHardLinkW AreFileApisANSI GetStringTypeW TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead WaitForSingleObjectEx SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW UnlockFile

ole32

CoUninitialize CoCreateGuid CoInitialize CoCreateInstance

shlwapi

PathFileExistsW

iphlpapi

GetAdaptersInfo

winmm

timeBeginPeriod timeKillEvent timeGetDevCaps timeSetEvent

generic

count=24, id=241, version=40116,

count=206, id=243, version=40116,

count=30, id=242, version=40116,

count=1, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=20, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=9, id=199, version=41118,

count=26, id=259, version=24237,

count=37, id=260, version=24237,

count=127, id=261, version=24237,

count=10, id=203, version=65501,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=261, version=24245,

count=315, id=1, productName=Unmarked objects,

count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=260, version=24245,

count=654, id=265, version=24245,

count=1, id=255, version=24245,

count=1, id=151,

count=1, id=258, version=24245,