2026-06-28_ddebc344f07b89565d96e18b19df3334_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop

General

Target
2026-06-28_ddebc344f07b89565d96e18b19df3334_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop
Size 34.0MB
Sample260628-w7fdfsbx2x
SHA256 ced2febc9af0fe950fc01012b6ce3439073320abc11fc54697d8c9376114a5ba
MD5 ddebc344f07b89565d96e18b19df3334
SHA1 1e9edf638abef4157a25add49dc6162138f1e6a4
SHA512 46365ca016fdbe6a8ef82881a251cbb6408136e0b50215b242fead394415f9de37b17f0382e27f2d5acbc7faf5af48cb42f3e9420f187bfbadddfbb5e9fc4b1d
SSDEEP 786432:sByRfTtLeu9wu0q9Z5BAiL9leZnCF8mqzt4C:sByRfTtLeFqz5BZL+gFxuL
TLSH
T1E1773302BB868672F44A163948A71B798BF76C65AF3393CB63507B1D2C333D16B34256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-28_ddebc344f07b89565d96e18b19df3334_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop

File Explorer

2026-06-28_ddebc344f07b89565d96e18b19df3334_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop

.exe 34.0MB

2026-06-28_ddebc344f07b89565d96e18b19df3334_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop

IMPHASH ccbd660d75e8df65cc93919427910a09
SHA256 ced2febc9af0fe950fc01012b6ce3439073320abc11fc54697d8c9376114a5ba
MD5 ddebc344f07b89565d96e18b19df3334
SHA1 1e9edf638abef4157a25add49dc6162138f1e6a4
SHA512 46365ca016fdbe6a8ef82881a251cbb6408136e0b50215b242fead394415f9de37b17f0382e27f2d5acbc7faf5af48cb42f3e9420f187bfbadddfbb5e9fc4b1d
SSDEEP 786432:sByRfTtLeu9wu0q9Z5BAiL9leZnCF8mqzt4C:sByRfTtLeFqz5BZL+gFxuL
TLSH
T1E1773302BB868672F44A163948A71B798BF76C65AF3393CB63507B1D2C333D16B34256
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

bc:51:fc:a9:c5:6c:92:d0:e5:68:5d:f4:73:8a:d6:01:3b:44:5d:21

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Global Graphics Software Limited,OU=Digital ID Class 3 - Microsoft VBA Software Validation v2,O=Global Graphics Software Limited,L=Cambridge,ST=Cambridgeshire,C=GB

Chains

Jun 27, 2012

CN=Global Graphics Software Limited,OU=Digital ID Class 3 - Microsoft VBA Software Validation v2,O=Global Graphics Software Limited,L=Cambridge,ST=Cambridgeshire,C=GB

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Global Graphics Software Limited,OU=Digital ID Class 3 - Microsoft VBA Software Validation v2,O=Global Graphics Software Limited,L=Cambridge,ST=Cambridgeshire,C=GB

Serial Number

26:e9:f4:9e:b7:e4:7e:0b:3c:a6:ea:dc:66:e5:47:b9

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 9, 2010 - Jun 9, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Minor OS version

0

Major OS version

4

Entry point

16863

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Users\acardy\workspaces\main\unity\depot\global\gdoc\CorelFusion\dev\DocCreator\win\MSPHost\release\MSPHost.pdb

kernel32

CreateDirectoryW GetModuleFileNameW GetLastError WaitForSingleObject FindResourceW SizeofResource LoadResource CreateProcessW CloseHandle LockResource GetExitCodeProcess GetTempPathW CompareStringW CompareStringA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RemoveDirectoryW DeleteFileW GetSystemTimeAsFileTime HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoW RaiseException RtlUnwind GetModuleHandleA GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement EnterCriticalSection LeaveCriticalSection Sleep WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode GetTimeZoneInformation ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA MultiByteToWideChar GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetCPInfo GetACP GetOEMCP IsValidCodePage VirtualAlloc HeapReAlloc SetStdHandle FlushFileBuffers SetFilePointer WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileW InitializeCriticalSection HeapSize LoadLibraryA GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW CreateFileA SetEndOfFile ReadFile SetEnvironmentVariableA

ole32

StringFromGUID2 CoCreateGuid

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_ddebc344f07b89565d96e18b19df3334_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop

PE Signature issue

kernel32

ole32

generic