2026-11-09_411698fdc0df3e9df3575ce2fa5e6211_coinminer_elex_glassworm_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_411698fdc0df3e9df3575ce2fa5e6211_coinminer_elex_glassworm_remcos
Size 9.3MB
Sample261110-1khbrabe27
SHA256 3631615ba70c9e28da8cfe3d831ccad9520633e8af551399cd1bf1a961414efb
MD5 411698fdc0df3e9df3575ce2fa5e6211
SHA1 a799aa5a2c94e4594fac8440b523b32e4c809bc7
SHA512 5617a448b9823e00bbc1a1691e38a00948a8c5a9a454a0804e80a7c771edf360e4e478adfd7e87635ac225ec0a14deae1a8fe8b274757c5b3390733b2af80b8e
SSDEEP 196608:MNPTDnaIURcHkpMnpGq93kJANuugFDtbTza:DVJJbq
TLSH
T1A4A65944FECBA8FAED575A34849EE37F9338AB104012DB83EA446917EC237D15E19319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_411698fdc0df3e9df3575ce2fa5e6211_coinminer_elex_glassworm_remcos

File Explorer

2026-11-09_411698fdc0df3e9df3575ce2fa5e6211_coinminer_elex_glassworm_remcos

.exe 9.3MB

2026-11-09_411698fdc0df3e9df3575ce2fa5e6211_coinminer_elex_glassworm_remcos

IMPHASH 3751a367fee8a4794ba51611eabf0176
SHA256 3631615ba70c9e28da8cfe3d831ccad9520633e8af551399cd1bf1a961414efb
MD5 411698fdc0df3e9df3575ce2fa5e6211
SHA1 a799aa5a2c94e4594fac8440b523b32e4c809bc7
SHA512 5617a448b9823e00bbc1a1691e38a00948a8c5a9a454a0804e80a7c771edf360e4e478adfd7e87635ac225ec0a14deae1a8fe8b274757c5b3390733b2af80b8e
SSDEEP 196608:MNPTDnaIURcHkpMnpGq93kJANuugFDtbTza:DVJJbq
TLSH
T1A4A65944FECBA8FAED575A34849EE37F9338AB104012DB83EA446917EC237D15E19319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptGenRandom GetSidIdentifierAuthority GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation LookupAccountSidW OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW

kernel32

CloseHandle CreateEventA CreateEventW CreateIoCompletionPort CreateSemaphoreW DeleteCriticalSection EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FileTimeToLocalFileTime FileTimeToSystemTime FreeEnvironmentStringsW GetCPInfo GetCommandLineW GetComputerNameW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessTimes GetQueuedCompletionStatus GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadPriority GetTickCount GetTimeZoneInformation GetVersionExW GlobalMemoryStatus InitializeCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection LoadLibraryA LocalFileTimeToFileTime MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency ReleaseSemaphore ResetEvent ResumeThread SetCurrentDirectoryW SetEnvironmentVariableW SetEvent SetHandleInformation SetLastError SetThreadPriority SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte

msvcrt

_assert __p__iob __lc_codepage __p___initenv __p___mb_cur_max __p__commode __p__fmode __set_app_type __setusermatherr _amsg_exit _beginthreadex _cexit _endthreadex _errno _initterm _setmode _stricmp _strnicmp mktime gmtime atexit abort atoi calloc exit fflush fprintf fputc free isspace ldexp localeconv malloc memchr memcmp memcpy memmove memset printf qsort realloc setvbuf signal strchr strcmp strcpy strerror strlen strncat strncmp strncpy strrchr strstr strtol strtoul time tolower vfprintf wcslen _fileno __getmainargs

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSARecv WSARecvFrom WSASend WSASendTo WSAStartup accept bind closesocket connect gethostbyaddr gethostbyname gethostname getpeername getsockname getsockopt ioctlsocket listen recv recvfrom select send sendto setsockopt shutdown socket

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5.3MB

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

860KB

Virtual Size

860KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

288KB

Virtual Size

287KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_411698fdc0df3e9df3575ce2fa5e6211_coinminer_elex_glassworm_remcos

advapi32

kernel32

msvcrt

ws2_32

generic