2026-11-01_b3b9ca7dc8412ec8f87538abbba1afab_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_metamorfo_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_b3b9ca7dc8412ec8f87538abbba1afab_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_metamorfo_njrat_remcos_revil
Size 4.5MB
Sample261102-ncf3hasybs
SHA256 727ed78c49dc0d5433475683bddb22e73b714f4049caac7284bdcb5e6d72a2c0
MD5 b3b9ca7dc8412ec8f87538abbba1afab
SHA1 c4c8893be18e43dbd87410f709ecfa91cfe61ce8
SHA512 a0e369a83f6ba8aedf053e165bed42ea02353eff5a5302aa81ea86e7ee73ddf517998c0e6e537f5a1f0cf8a3ad58f9dcf5bde69655e486b25f4b21ddec457b46
SSDEEP 98304:gNlIB3RN8YGABDJNFOOd0TPmeRILo8BHViUUsf:JB3R74meOLRiof
TLSH
T105267C31FA8B4C73E5911236446F76669AAFAE00072147C7A2D82BE96F301D13E3779D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_b3b9ca7dc8412ec8f87538abbba1afab_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_metamorfo_njrat_remcos_revil

File Explorer

2026-11-01_b3b9ca7dc8412ec8f87538abbba1afab_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_metamorfo_njrat_remcos_revil

.exe 4.5MB

2026-11-01_b3b9ca7dc8412ec8f87538abbba1afab_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_metamorfo_njrat_remcos_revil

IMPHASH 045a65f1f51e960bb83add92db4198fa
SHA256 727ed78c49dc0d5433475683bddb22e73b714f4049caac7284bdcb5e6d72a2c0
MD5 b3b9ca7dc8412ec8f87538abbba1afab
SHA1 c4c8893be18e43dbd87410f709ecfa91cfe61ce8
SHA512 a0e369a83f6ba8aedf053e165bed42ea02353eff5a5302aa81ea86e7ee73ddf517998c0e6e537f5a1f0cf8a3ad58f9dcf5bde69655e486b25f4b21ddec457b46
SSDEEP 98304:gNlIB3RN8YGABDJNFOOd0TPmeRILo8BHViUUsf:JB3R74meOLRiof
TLSH
T105267C31FA8B4C73E5911236446F76669AAFAE00072147C7A2D82BE96F301D13E3779D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2058994

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Prog\CrashRptRail\bin\rail_crash_sender.pdb

kernel32

GetProcAddress FreeLibrary GetProcessTimes FileTimeToSystemTime GetSystemTime GetFileAttributesW GetCurrentThreadId GetCommandLineW CreateThread GetCurrentProcess ReadFile WriteFile CreateProcessW GetFileInformationByHandle CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId TerminateProcess DeleteFileW RemoveDirectoryW TerminateThread Sleep GetTickCount RaiseException DecodePointer OutputDebugStringA CreateDirectoryW WritePrivateProfileStringW GetModuleHandleExW GetModuleFileNameW GetTempPathW GetPrivateProfileStringW FormatMessageW GetFileAttributesExW GlobalAlloc GlobalFree SystemTimeToFileTime GetModuleHandleW SystemTimeToTzSpecificLocalTime GetTempFileNameW TryEnterCriticalSection CreateMutexA ReleaseMutex OpenFileMappingW UnmapViewOfFile GetSystemInfo CreateFileMappingW MapViewOfFile SetConsoleCtrlHandler WriteConsoleW GetModuleFileNameA GetConsoleMode GetConsoleCP CreateProcessA GetDriveTypeW RtlUnwind WaitForMultipleObjectsEx TzSpecificLocalTimeToSystemTime SetFileTime CopyFileA UnlockFileEx LoadLibraryW ReadProcessMemory OpenProcess FindClose FindNextFileW GetFileTime FindFirstFileW GetFileSizeEx CreateFileW MultiByteToWideChar UnlockFile LockFileEx LockFile GetFileSize GetFileAttributesA DeleteFileA CreateFileA CreateDirectoryA CreateTimerQueue UnregisterWaitEx WaitForSingleObject QueryDepthSList InterlockedFlushSList SetEvent InterlockedPushEntrySList LeaveCriticalSection Module32First Process32Next Process32First GetVersionExA GetLocalTime SetFilePointer GenerateConsoleCtrlEvent RtlCaptureStackBackTrace FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA GetProcessHeap HeapSize CreatePipe GetExitCodeProcess FlushFileBuffers GetTimeZoneInformation SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW ReadConsoleW GetACP HeapReAlloc MoveFileExW GetCurrentDirectoryW GetCurrentDirectoryA SetCurrentDirectoryW SetCurrentDirectoryA SetEnvironmentVariableW SetEnvironmentVariableA GetFullPathNameA GetFullPathNameW HeapFree HeapAlloc SetConsoleMode InterlockedPopEntrySList ReleaseSemaphore ReadConsoleInputA PeekConsoleInputA DuplicateHandle GetNumberOfConsoleInputEvents ResumeThread ExitThread SetProcessAffinityMask ResetEvent EnterCriticalSection CloseHandle CreateEventW VirtualProtect DeleteCriticalSection InitializeCriticalSectionAndSpinCount VirtualFree VirtualAlloc GetLastError WideCharToMultiByte GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle InitializeCriticalSection GetTempPathA GetWindowsDirectoryA GetComputerNameA GetSystemTimeAsFileTime GetModuleHandleA GetFileType SetLastError FormatMessageA SleepEx VerifyVersionInfoA GetSystemDirectoryA LoadLibraryA VerSetConditionMask ExpandEnvironmentStringsA WaitForMultipleObjects PeekNamedPipe FindFirstFileA FindNextFileA GlobalMemoryStatus QueryPerformanceCounter FlushConsoleInputBuffer IsDebuggerPresent OutputDebugStringW QueryPerformanceFrequency FindFirstFileExW GetDiskFreeSpaceExW SetEndOfFile SetFileAttributesW SetFilePointerEx CopyFileW CreateHardLinkW AreFileApisANSI GetStringTypeW TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead WaitForSingleObjectEx SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW GetVersionExW ExitProcess

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxA UnregisterClassW GetGuiResources ReleaseDC GetDC

shell32

SHGetFileInfoW ExtractIconW CommandLineToArgvW SHGetSpecialFolderPathW SHFileOperationW

ole32

CoCreateGuid CoInitialize CoCreateInstance CoUninitialize

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegQueryInfoKeyW RegEnumKeyExW RegEnumValueW RegCloseKey RegQueryValueExW DeregisterEventSource ReportEventA RegisterEventSourceA OpenProcessToken

ws2_32

freeaddrinfo sendto __WSAFDIsSet bind WSAIoctl closesocket WSASetLastError getpeername getsockname socket ntohs connect inet_addr listen accept getaddrinfo recvfrom gethostname getsockopt htons setsockopt send recv WSAGetLastError WSACleanup WSAStartup shutdown getservbyname ioctlsocket gethostbyname select htonl ntohl inet_ntoa

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

psapi

GetProcessMemoryInfo

wldap32

ord143 ord60 ord41 ord33 ord79 ord200 ord27 ord26 ord46 ord22 ord301 ord211 ord35 ord30 ord50 ord32

normaliz

IdnToAscii IdnToUnicode

gdi32

DeleteObject GetDeviceCaps GetDIBits CreateCompatibleBitmap GetObjectA

shlwapi

PathFileExistsW

iphlpapi

GetAdaptersInfo

winmm

timeGetDevCaps timeKillEvent timeSetEvent timeBeginPeriod

generic

count=24, id=241, version=40116,

count=206, id=243, version=40116,

count=30, id=242, version=40116,

count=1, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=20, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=9, id=199, version=41118,

count=26, id=259, version=24123,

count=125, id=261, version=24123,

count=37, id=260, version=24123,

count=2, id=261, version=23013,

count=6, id=203, version=65501,

count=4, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=2, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=315, id=1, productName=Unmarked objects,

count=654, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,