2026-07-02_58b57533fcf12a9db8370a7c380ed48a_coinminer_elex_kwampirs_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-02_58b57533fcf12a9db8370a7c380ed48a_coinminer_elex_kwampirs_mafia
Size 1.7MB
Sample260702-2rwndsf14w
SHA256 1defb07d7030c9ccb8b9fbb2c50835ef14c52706458e96d253865f1f525d37be
MD5 58b57533fcf12a9db8370a7c380ed48a
SHA1 f51ad6d22249159e0423b1a1a7f7e6ca18ad7c0d
SHA512 62a104d824ffadcb7f3476120aa1c1dc92559a0b6bba69aed516816ebc830d83900e3c9123a3b37b50ef672f38073fd7d8807da65a74e349c2468b527affd382
SSDEEP 24576:QUNx+O2Y52FaGZTKYD0AtMnQ/tbw/2Mkjy6Fr7g0oW:uRY52FaG8YD0ASQ/lFTjN4
TLSH
T10B85E0217BF5D036E4A312B59E7ADB6A493AE4601B3051CBF3C40A6E5E707C29B3531B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_58b57533fcf12a9db8370a7c380ed48a_coinminer_elex_kwampirs_mafia

File Explorer

2026-07-02_58b57533fcf12a9db8370a7c380ed48a_coinminer_elex_kwampirs_mafia

.exe 1.7MB

2026-07-02_58b57533fcf12a9db8370a7c380ed48a_coinminer_elex_kwampirs_mafia

IMPHASH 3c214c8050a1a2606dc2b346d8391e5e
SHA256 1defb07d7030c9ccb8b9fbb2c50835ef14c52706458e96d253865f1f525d37be
MD5 58b57533fcf12a9db8370a7c380ed48a
SHA1 f51ad6d22249159e0423b1a1a7f7e6ca18ad7c0d
SHA512 62a104d824ffadcb7f3476120aa1c1dc92559a0b6bba69aed516816ebc830d83900e3c9123a3b37b50ef672f38073fd7d8807da65a74e349c2468b527affd382
SSDEEP 24576:QUNx+O2Y52FaGZTKYD0AtMnQ/tbw/2Mkjy6Fr7g0oW:uRY52FaG8YD0ASQ/lFTjN4
TLSH
T10B85E0217BF5D036E4A312B59E7ADB6A493AE4601B3051CBF3C40A6E5E707C29B3531B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

217032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\Desarrollo\TFS\Installers\Products\CloudAv\Release\Version 7.05.00.0047.x\Source\Code\Projects\PSINanoRun\ProjectWin\bin\Release\PSINanoRun.pdb

gdiplus

GdiplusShutdown GdiplusStartup

kernel32

LoadLibraryA LoadLibraryExA FormatMessageA LocalFree GetDateFormatW OutputDebugStringW GetTimeFormatW GetLocalTime GetCurrentThreadId HeapAlloc HeapFree LocalAlloc EnumSystemLocalesA GetFileAttributesW GetUserDefaultLCID GetStringTypeW WriteConsoleW SetStdHandle InterlockedExchange GetProcessHeap CreateFileW HeapSetInformation ReadFile WriteFile CreateDirectoryW SetFilePointer InterlockedCompareExchange GetVersionExA lstrcmpiW GetVersionExW GetTempPathW GetExitCodeProcess GetCurrentProcessId CloseHandle TerminateProcess LoadLibraryW OpenProcess WaitForSingleObject GetCurrentProcess CreateProcessW GetUserDefaultLangID SetLastError GetModuleHandleW MultiByteToWideChar WideCharToMultiByte GetEnvironmentVariableW DeleteFileW GetTempFileNameW GetLastError WritePrivateProfileStringW Sleep GetCommandLineW DeleteCriticalSection EnterCriticalSection GetProcAddress GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection GetModuleHandleExW InterlockedDecrement InterlockedIncrement LoadLibraryExW GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP FreeLibrary IsValidLocale SetEndOfFile GetLocaleInfoA EncodePointer DecodePointer GetStartupInfoW HeapReAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InitializeCriticalSectionAndSpinCount RtlUnwind SetHandleCount GetStdHandle GetFileType IsProcessorFeaturePresent HeapCreate ExitProcess GetConsoleCP GetConsoleMode FlushFileBuffers RaiseException HeapSize GetLocaleInfoW GetCPInfo GetACP

user32

GetSystemMetrics MessageBoxW

advapi32

GetTokenInformation RegQueryValueExW CreateProcessAsUserW FreeSid CryptHashData CryptDestroyHash CryptCreateHash CryptReleaseContext CryptGetHashParam RegSetValueExW RegDeleteValueW RegCreateKeyExW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegCloseKey AdjustTokenPrivileges RegOpenKeyExW RevertToSelf ImpersonateLoggedOnUser LookupPrivilegeValueW SetTokenInformation OpenProcessToken

shell32

FindExecutableW ShellExecuteW

ole32

CLSIDFromString CoInitializeEx CoUninitialize

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_58b57533fcf12a9db8370a7c380ed48a_coinminer_elex_kwampirs_mafia

gdiplus

kernel32

user32

advapi32

shell32

ole32

generic