2026-06-27_f519df7c88fa674d0f7c724e3d6b8e09_coinminer_elex_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_f519df7c88fa674d0f7c724e3d6b8e09_coinminer_elex_remcos_stop
Size 8.4MB
Sample260629-bphqmsbs9l
SHA256 1e32e548079745595ff37273f3e86012c214385a11134276428d3c8d738ce21b
MD5 f519df7c88fa674d0f7c724e3d6b8e09
SHA1 f1ab640752bb2f100a73c41c0d48b2c0bae694d2
SHA512 c33c381ddd45acf69c2798bdb24d25240431fb8d9994b42e9ea275fa09c4471f81245cc356550c4f802d662df7cebf3e3c8afc9e29216dcc1d0e71b8921a9cb9
SSDEEP 98304:SJC7k2EO2OJ3H8UAE/IXjmI6BLYontI8V+AQrK8iEVdWJI:ZQ2ECjwXaI6BLYub+A+K8iEVdWJI
TLSH
T1B4966C13B2CCC0B7F112B670694DE39C8137BD55462CA05F7364751A8EB2AE2FA39276
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-27_f519df7c88fa674d0f7c724e3d6b8e09_coinminer_elex_remcos_stop

File Explorer

2026-06-27_f519df7c88fa674d0f7c724e3d6b8e09_coinminer_elex_remcos_stop

.exe 8.4MB

2026-06-27_f519df7c88fa674d0f7c724e3d6b8e09_coinminer_elex_remcos_stop

IMPHASH 0de174b7cb5f7e0e29ae73d78946fb46
SHA256 1e32e548079745595ff37273f3e86012c214385a11134276428d3c8d738ce21b
MD5 f519df7c88fa674d0f7c724e3d6b8e09
SHA1 f1ab640752bb2f100a73c41c0d48b2c0bae694d2
SHA512 c33c381ddd45acf69c2798bdb24d25240431fb8d9994b42e9ea275fa09c4471f81245cc356550c4f802d662df7cebf3e3c8afc9e29216dcc1d0e71b8921a9cb9
SSDEEP 98304:SJC7k2EO2OJ3H8UAE/IXjmI6BLYontI8V+AQrK8iEVdWJI:ZQ2ECjwXaI6BLYub+A+K8iEVdWJI
TLSH
T1B4966C13B2CCC0B7F112B670694DE39C8137BD55462CA05F7364751A8EB2AE2FA39276
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5144090

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\FFTeam\FFDev\FFDev_Korea\branch\CT_20120626(B0626)\FFClient\run\FF2Client.pdb

shell32

SHAppBarMessage SHFileOperationW SHCreateDirectoryExW SHGetSpecialFolderPathW CommandLineToArgvW ShellExecuteW

winmm

timeBeginPeriod timeGetTime timeEndPeriod

dinput8

DirectInput8Create

imm32

ImmCreateContext ImmGetProperty ImmGetOpenStatus ImmDestroyContext ImmIsIME ImmGetContext ImmGetConversionStatus ImmSetConversionStatus ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetCandidateWindow ImmNotifyIME ImmGetCandidateListW ImmGetCompositionStringW ImmGetIMEFileNameW ImmAssociateContext

wininet

InternetQueryDataAvailable InternetReadFile InternetOpenUrlW InternetOpenW InternetCloseHandle

xinput1_3

ord2

zlib

ord39 ord26

ddraw

DirectDrawCreateEx DirectDrawCreate

mss32

_AIL_stop_sample@4 _AIL_set_sample_volume_pan@12 _AIL_resume_sample@4 _AIL_register_EOS_callback@8 _AIL_set_sample_user_data@12 _AIL_set_named_sample_file@20 _AIL_init_sample@12 _AIL_end_sample@4 _AIL_sample_status@4 _AIL_shutdown@0 _AIL_close_digital_driver@4 _AIL_release_sample_handle@4 _AIL_allocate_sample_handle@4 _AIL_set_preference@8 _AIL_open_digital_driver@16 _AIL_startup@0 _AIL_set_redist_directory@4 _AIL_sample_volume_pan@12 _AIL_sample_user_data@8 _AIL_start_sample@4

psapi

GetModuleBaseNameW

kernel32

HeapAlloc DeleteCriticalSection InitializeCriticalSectionAndSpinCount InterlockedExchange WideCharToMultiByte GetTickCount GetLocalTime SetLastError GetLastError CloseHandle SetFilePointer UnmapViewOfFile SetEndOfFile GetFileSize FlushFileBuffers FlushViewOfFile WriteFile ReadFile GetPrivateProfileStringW WritePrivateProfileStringW MultiByteToWideChar Sleep SetEvent CreateFileW OutputDebugStringW InitializeCriticalSection GetProcAddress LoadLibraryW GlobalMemoryStatusEx lstrlenA FreeLibrary HeapSetInformation FindFirstFileW DeleteFileW CreateProcessW GetCurrentDirectoryW GetVersionExW GetSystemDirectoryW lstrlenW GetModuleHandleW lstrcmpiW RaiseException SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW CreateEventW SuspendThread WaitForSingleObject ResumeThread SetThreadPriority GetTempPathW GetTempFileNameW ResetEvent GlobalAlloc GlobalLock GlobalFree GlobalUnlock FindClose GetTempFileNameA LoadLibraryA GetCommandLineW GetDiskFreeSpaceExW GetCurrentThreadId VirtualQuery SetUnhandledExceptionFilter GetCurrentProcess GetCurrentThread FormatMessageW IsBadWritePtr SetCurrentDirectoryW GetCurrentProcessId DebugBreak MapViewOfFile CreateFileMappingW GetSystemInfo IsDBCSLeadByte LocalAlloc LocalFree FlushInstructionCache MulDiv lstrcmpW lstrcpyW SystemTimeToFileTime FileTimeToSystemTime InterlockedDecrement OpenEventW GetModuleHandleA OutputDebugStringA CreateFileMappingA CreateFileA GetVersionExA IsProcessorFeaturePresent InterlockedCompareExchange ExpandEnvironmentStringsA VirtualFree VirtualAlloc DeleteFileA MoveFileExA CopyFileA OpenEventA CreateEventA CreateProcessA WaitForMultipleObjects GetExitCodeProcess CreateMutexA SetEnvironmentVariableA GetDriveTypeA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW CompareStringW CompareStringA GetFileAttributesA GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetTimeZoneInformation GetStartupInfoA GetFileType SetHandleCount GetCurrentDirectoryA GetFullPathNameW GetConsoleMode GetConsoleCP HeapCreate LCMapStringA LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo GetModuleFileNameA GetStdHandle HeapSize TlsFree TlsSetValue TlsAlloc TlsGetValue HeapReAlloc GetTempPathA RtlUnwind GetStartupInfoW IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetDriveTypeW FileTimeToLocalFileTime CreateThread ExitThread ExitProcess GetSystemTimeAsFileTime DuplicateHandle CreatePipe PeekNamedPipe lstrcpyA InterlockedIncrement HeapFree GetProcessHeap EnterCriticalSection LeaveCriticalSection LoadLibraryExA OpenFileMappingA lstrcatA CreateDirectoryA OpenMutexA TerminateThread ReleaseMutex GetComputerNameA lstrcmpA IsBadReadPtr GlobalMemoryStatus GetSystemDirectoryA FindNextFileW MoveFileA

user32

wsprintfA UnregisterClassA GetCursorPos wvsprintfW GetKeyState GetSystemMetrics SetWindowPos EnumDisplayMonitors GetMonitorInfoW BringWindowToTop GetWindowLongW SetWindowLongW GetWindowRect SetParent CharPrevW EnumDisplayDevicesW EqualRect SetRectEmpty IntersectRect UpdateWindow ShowWindow RegisterWindowMessageW FindWindowW GetWindowTextW SetWindowTextW IsChild GetAsyncKeyState ScreenToClient SystemParametersInfoW MessageBoxW CharNextW SetCursorPos OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsClipboardFormatAvailable GetClipboardData InSendMessage SetCapture ReleaseCapture ValidateRect SetCursor LoadCursorW DefWindowProcW PeekMessageW TranslateMessage DispatchMessageW GetKeyboardLayout InvalidateRect GetWindowTextLengthW GetFocus SetFocus GetWindow GetDlgItem BeginPaint EndPaint SendMessageW IsWindow GetClassNameW GetSysColor RedrawWindow GetClassInfoExW CreateWindowExW CreateAcceleratorTableW GetParent MoveWindow InvalidateRgn DestroyAcceleratorTable RegisterClassExW GetKeyboardLayoutList GetDesktopWindow PostMessageW wsprintfW PostQuitMessage DestroyWindow GetMessageW AnimateWindow CreateDialogParamW MessageBeep PostThreadMessageW SetRect OffsetRect GetClientRect ClientToScreen ReleaseDC FillRect GetDC CallWindowProcW

gdi32

DeleteDC GetObjectW GetDeviceCaps RemoveFontMemResourceEx AddFontMemResourceEx PatBlt CreateSolidBrush DeleteObject StretchBlt CreateCompatibleBitmap BitBlt GetTextExtentPoint32W CreateDIBSection CreateFontIndirectW SetTextAlign SetTextColor SetBkMode EnumFontFamiliesExW GetTextMetricsW GetStockObject CreateCompatibleDC SelectObject TextOutW

advapi32

RegOpenKeyW RegQueryValueExW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW CryptGetHashParam CryptDeriveKey CryptCreateHash RegCloseKey RegDeleteKeyW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegDeleteValueA RegCreateKeyA RegQueryValueExA RegOpenKeyA RegSetValueExA CryptReleaseContext CryptDestroyKey CryptEncrypt CryptImportKey CryptAcquireContextA GetUserNameA RegCreateKeyExA RegOpenKeyExA RegEnumValueA CryptDestroyHash CryptHashData CryptVerifySignatureA RegQueryInfoKeyW

ole32

OleInitialize CLSIDFromString CLSIDFromProgID CoGetClassObject CreateStreamOnHGlobal OleLockRunning StringFromGUID2 OleUninitialize CoUninitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoInitialize

oleaut32

SysFreeString VariantClear VariantInit DispCallFunc SysAllocString SysStringLen OleCreateFontIndirect LoadRegTypeLi LoadTypeLi SysAllocStringLen VarUI4FromStr

ws2_32

WSACreateEvent WSACloseEvent connect socket WSAGetLastError inet_ntoa ntohs htonl htons closesocket gethostname gethostbyname inet_addr WSASend sendto WSAStartup WSACleanup WSAEnumNetworkEvents ntohl send WSAWaitForMultipleEvents getpeername recv WSAEventSelect

shlwapi

SHGetValueW

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo

generic

count=9, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=1, id=150, version=20413,

count=70, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=83, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=224, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=28, id=109, productName=VS2005 build 50727, version=50727,

count=2, id=25, productName=VS2002 (.NET) build 9466, version=9466,

count=4, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=17, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=6, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=119, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=476, id=1, productName=Unmarked objects,

count=33, id=123, productName=VS2005 build 50727, version=50727,

count=1180, id=138, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,