2026-07-20_22eb3a8123f051031e3d0fb7ce6a3f70_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop

General

Target
2026-07-20_22eb3a8123f051031e3d0fb7ce6a3f70_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop
Size 34.0MB
Sample260720-md2vxsew4l
SHA256 d9b8e9ecdfc5397c70d00850b19e327ece2d5c4e708fe19f8800411997bd1658
MD5 22eb3a8123f051031e3d0fb7ce6a3f70
SHA1 914e272b1813d90b08e875d5d0f72d0c3f61771a
SHA512 be7bec59879c50d61d89886ff426afc6bed5267889f564fbb459b84690850b7b9353943468e6645121fddcd247309b6143492cb1fe8690b6ff72fcf2b16633ad
SSDEEP 786432:yByRfTtLeu9wu0q9Z5BAiL9leZnCF8mqzt4g:yByRfTtLeFqz5BZL+gFxux
TLSH
T104773302BB868672F44A163948A71B798BF76C65AF3393CB63507B1D2C333D16B34256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-20_22eb3a8123f051031e3d0fb7ce6a3f70_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop

File Explorer

2026-07-20_22eb3a8123f051031e3d0fb7ce6a3f70_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop

.exe 34.0MB

2026-07-20_22eb3a8123f051031e3d0fb7ce6a3f70_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop

IMPHASH ccbd660d75e8df65cc93919427910a09
SHA256 d9b8e9ecdfc5397c70d00850b19e327ece2d5c4e708fe19f8800411997bd1658
MD5 22eb3a8123f051031e3d0fb7ce6a3f70
SHA1 914e272b1813d90b08e875d5d0f72d0c3f61771a
SHA512 be7bec59879c50d61d89886ff426afc6bed5267889f564fbb459b84690850b7b9353943468e6645121fddcd247309b6143492cb1fe8690b6ff72fcf2b16633ad
SSDEEP 786432:yByRfTtLeu9wu0q9Z5BAiL9leZnCF8mqzt4g:yByRfTtLeFqz5BZL+gFxux
TLSH
T104773302BB868672F44A163948A71B798BF76C65AF3393CB63507B1D2C333D16B34256
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

69:4c:16:43:80:13:d3:d0:70:d6:9f:ea:16:17:d4:8f:0f:6a:bd:97

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Global Graphics Software Limited,OU=Digital ID Class 3 - Microsoft VBA Software Validation v2,O=Global Graphics Software Limited,L=Cambridge,ST=Cambridgeshire,C=GB

Chains

Jun 27, 2012

CN=Global Graphics Software Limited,OU=Digital ID Class 3 - Microsoft VBA Software Validation v2,O=Global Graphics Software Limited,L=Cambridge,ST=Cambridgeshire,C=GB

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Global Graphics Software Limited,OU=Digital ID Class 3 - Microsoft VBA Software Validation v2,O=Global Graphics Software Limited,L=Cambridge,ST=Cambridgeshire,C=GB

Serial Number

26:e9:f4:9e:b7:e4:7e:0b:3c:a6:ea:dc:66:e5:47:b9

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 9, 2010 - Jun 9, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Minor OS version

0

Major OS version

4

Entry point

16863

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Users\acardy\workspaces\main\unity\depot\global\gdoc\CorelFusion\dev\DocCreator\win\MSPHost\release\MSPHost.pdb

kernel32

CreateDirectoryW GetModuleFileNameW GetLastError WaitForSingleObject FindResourceW SizeofResource LoadResource CreateProcessW CloseHandle LockResource GetExitCodeProcess GetTempPathW CompareStringW CompareStringA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RemoveDirectoryW DeleteFileW GetSystemTimeAsFileTime HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoW RaiseException RtlUnwind GetModuleHandleA GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement EnterCriticalSection LeaveCriticalSection Sleep WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode GetTimeZoneInformation ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA MultiByteToWideChar GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetCPInfo GetACP GetOEMCP IsValidCodePage VirtualAlloc HeapReAlloc SetStdHandle FlushFileBuffers SetFilePointer WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileW InitializeCriticalSection HeapSize LoadLibraryA GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW CreateFileA SetEndOfFile ReadFile SetEnvironmentVariableA

ole32

StringFromGUID2 CoCreateGuid

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_22eb3a8123f051031e3d0fb7ce6a3f70_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop

PE Signature issue

kernel32

ole32

generic