2026-07-30_1d194ff317762c7e6ceb59d48841d9ed_coinminer_elex_rhadamanthys_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_1d194ff317762c7e6ceb59d48841d9ed_coinminer_elex_rhadamanthys_stealc_stop
Size 3.4MB
Sample260730-tacvysvxcs
SHA256 93e4095b70744603c56645e8a016a142e0d778f4dd3e94de0482c6636e14ab10
MD5 1d194ff317762c7e6ceb59d48841d9ed
SHA1 e191959f67d877f45d3ff530e6ba192bbaaedae8
SHA512 1bce753220a425a7cd86cf1559cbeccb530994184c5c645557c7316d447423dc7891829150cdd4e59d30bc08c59cf651eaf53e9e0886ea63cb80f3b3ae8e4eb1
SSDEEP 24576:+KLmKkMM8tC41iElYy/5ZZQw5/mdD0Lf:pChD0iEOy/5zQw5/my
TLSH
T105F54B01F6019179F8B708FACAFF967D992AAD71431500C3A3C47E6E7A659E33A31136
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-30_1d194ff317762c7e6ceb59d48841d9ed_coinminer_elex_rhadamanthys_stealc_stop

File Explorer

2026-07-30_1d194ff317762c7e6ceb59d48841d9ed_coinminer_elex_rhadamanthys_stealc_stop

.exe 3.4MB

2026-07-30_1d194ff317762c7e6ceb59d48841d9ed_coinminer_elex_rhadamanthys_stealc_stop

IMPHASH 3b038a7409d33551a9d8b2ee2762dbca
SHA256 93e4095b70744603c56645e8a016a142e0d778f4dd3e94de0482c6636e14ab10
MD5 1d194ff317762c7e6ceb59d48841d9ed
SHA1 e191959f67d877f45d3ff530e6ba192bbaaedae8
SHA512 1bce753220a425a7cd86cf1559cbeccb530994184c5c645557c7316d447423dc7891829150cdd4e59d30bc08c59cf651eaf53e9e0886ea63cb80f3b3ae8e4eb1
SSDEEP 24576:+KLmKkMM8tC41iElYy/5ZZQw5/mdD0Lf:pChD0iEOy/5zQw5/my
TLSH
T105F54B01F6019179F8B708FACAFF967D992AAD71431500C3A3C47E6E7A659E33A31136
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

7c:6c:ff:b1:e0:9f:cd:00:d1:36:05:e2:f0:d8:59:c2:9b:6d:40:b3:f7:df:78:43:b1:95:e5:03:c2:52:b0:62

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Chains

Nov 6, 2017

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

82:05:91:86:6e:28:f6:37:fc:cc:99:1a:15:91:c9:d6:74:10:e6:99

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Chains

Nov 6, 2017

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Serial Number

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 6, 2016 - Mar 28, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Serial Number

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 28, 2015 - Mar 28, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

Major OS version

Entry point

692456

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\211239\out\Release\360Safe.pdb

kernel32

ReleaseMutex Process32NextW Process32FirstW CreateToolhelp32Snapshot GetLongPathNameW GetShortPathNameW GetStartupInfoW GlobalFree GlobalAlloc GetTickCount WaitForMultipleObjects GlobalAddAtomW DeleteFileW GetProcessTimes FileTimeToSystemTime SystemTimeToFileTime FileTimeToLocalFileTime GetTempFileNameW GetTempPathW CopyFileW ReadFile GlobalUnlock GlobalLock CreateFileA GetFileAttributesExW FindClose FindNextFileW FindFirstFileW MoveFileExW SetFileAttributesW RemoveDirectoryW GetFileAttributesW GetDriveTypeW GetLogicalDriveStringsW MapViewOfFileEx CreateFileMappingW UnmapViewOfFile CreateRemoteThread GetWindowsDirectoryW GetSystemDirectoryW LoadLibraryA ProcessIdToSessionId OpenMutexW WTSGetActiveConsoleSessionId GetComputerNameW GetVersion ExpandEnvironmentStringsW OutputDebugStringW SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers GetLocaleInfoW GetConsoleMode GetConsoleCP CreateFileW GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoA SetHandleCount GetFileType SetStdHandle GetTimeZoneInformation InitializeCriticalSectionAndSpinCount GetModuleFileNameA GetStdHandle HeapCreate GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID IsValidCodePage CreateMutexW GetACP GetDateFormatA GetTimeFormatA GetStringTypeW LCMapStringW LCMapStringA GetCPInfo MoveFileW IsDebuggerPresent UnhandledExceptionFilter CreateThread ExitThread ExitProcess RtlUnwind TlsFree DeleteAtom FindAtomW TlsAlloc AddAtomW OpenThread GetAtomNameW TlsSetValue TlsGetValue GetSystemTime FormatMessageW SetFilePointerEx LocalFileTimeToFileTime GetSystemTimeAsFileTime InterlockedExchange VirtualAlloc VirtualFree IsProcessorFeaturePresent GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy CreateProcessW GetCurrentProcessId DeviceIoControl GetVersionExW GetPrivateProfileIntW GetLocalTime SetUnhandledExceptionFilter GlobalFindAtomW GlobalDeleteAtom GetFileSize SetEvent WaitForSingleObject CreateEventW InterlockedCompareExchange Sleep LoadLibraryW FlushInstructionCache SetLastError LocalFree OpenProcess CloseHandle GetPrivateProfileStringW lstrcmpiW LoadLibraryExW MultiByteToWideChar FreeLibrary InitializeCriticalSection GetLastError lstrlenW GetModuleFileNameW DeleteCriticalSection InterlockedDecrement InterlockedIncrement LeaveCriticalSection EnterCriticalSection FindResourceExW LoadResource LockResource SizeofResource TerminateProcess FindResourceW RaiseException GetCurrentThreadId GetModuleHandleW VirtualProtect GetModuleHandleA GetProcAddress GetFileSizeEx SetFilePointer WideCharToMultiByte SetEndOfFile GetOEMCP WriteFile GetCommandLineW GetCurrentProcess QueryPerformanceCounter

user32

RegisterWindowMessageW DefWindowProcW UnregisterClassA DispatchMessageW TranslateMessage GetMessageW PeekMessageW CharNextW FindWindowW ReleaseDC GetDC GetWindowThreadProcessId IsWindow WaitForInputIdle SendMessageTimeoutW CreateWindowExW SetWindowLongW MessageBoxW GetActiveWindow GetClassInfoExW LoadCursorW RegisterClassExW ShowWindow DialogBoxParamW EndDialog DestroyWindow GetWindowLongW SetWindowPos MapWindowPoints GetClientRect GetMonitorInfoW MonitorFromWindow GetWindowRect GetWindow GetParent SendMessageW FindWindowExW PostMessageW DisableProcessWindowsGhosting PostQuitMessage LoadImageW GetSystemMetrics SetLayeredWindowAttributes CreateDialogParamW SetWindowTextW RedrawWindow SetTimer KillTimer IsWindowEnabled CallWindowProcW CopyRect ScreenToClient GetCursorPos EnableWindow GetDesktopWindow IsWindowVisible SetRect SubtractRect SetActiveWindow BringWindowToTop SetForegroundWindow IsIconic SetCursor OffsetRect AllowSetForegroundWindow LoadStringW wsprintfW EndPaint BeginPaint MoveWindow InvalidateRect IntersectRect

gdi32

BitBlt GetTextExtentPoint32W DeleteDC CreateCompatibleBitmap SetViewportOrgEx SelectObject CreateCompatibleDC DeleteObject

advapi32

SetEntriesInAclW RegDeleteKeyW RegDeleteValueW CryptGenRandom CryptReleaseContext CryptAcquireContextW LookupPrivilegeValueW AdjustTokenPrivileges GetNamedSecurityInfoW SetNamedSecurityInfoW RegUnLoadKeyW RegLoadKeyW RegEnumValueW DuplicateTokenEx GetLengthSid SetTokenInformation CreateProcessAsUserW LookupAccountSidW RegCreateKeyA ConvertStringSidToSidW OpenProcessToken GetTokenInformation QueryServiceStatus OpenSCManagerW OpenServiceW StartServiceW ChangeServiceConfigW ControlService CloseServiceHandle RegOpenKeyW RegQueryValueExW RegQueryInfoKeyW RegSetValueExW RegEnumKeyExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegQueryValueExA

shell32

SHGetSpecialFolderPathW SHAppBarMessage ord165 CommandLineToArgvW ShellExecuteW ShellExecuteExW SHCreateDirectoryExW SHGetFolderPathW SHChangeNotify

ole32

CreateStreamOnHGlobal CoUninitialize CoCreateGuid CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoCreateInstance CoInitialize

oleaut32

SafeArrayRedim SafeArrayGetUBound SafeArrayGetLBound VariantCopy VarUI4FromStr SysFreeString DispCallFunc SysAllocString VariantInit VariantClear SysAllocStringLen SysAllocStringByteLen SysStringByteLen SafeArrayCopy SafeArrayGetVartype SafeArrayCreate SafeArrayDestroy SafeArrayLock SafeArrayUnlock SysStringLen

shlwapi

PathFindFileNameW PathFindExtensionW PathFindFileNameA SHGetValueA SHSetValueA PathRemoveExtensionW StrCmpIW SHDeleteKeyW SHSetValueW StrStrIW SHGetValueW PathAppendW SHDeleteValueW PathCombineW PathRemoveFileSpecW PathIsRelativeW PathFileExistsW

comctl32

InitCommonControlsEx _TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipGetImageHeight GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromFile GdipCloneImage GdipFree GdipCreateBitmapFromStreamICM GdipAlloc GdipGetImageWidth GdipDrawImageRectRectI GdipCreateBitmapFromStream GdipDisposeImage GdipDeleteCachedBitmap GdipCreateCachedBitmap GdipRestoreGraphics GdipSaveGraphics GdipDrawImageI GdipCreateBitmapFromScan0 GdipDrawImageRectRect GdipDrawImageRectI GdipFillRectangleI GdipSetSmoothingMode GdipDeleteGraphics GdipGetImageGraphicsContext GdipCreateFromHDC GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipCreateBitmapFromFileICM

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wintrust

WinVerifyTrust WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

rpcrt4

NdrClientCall2

psapi

GetModuleFileNameExW

iphlpapi

NotifyAddrChange GetAdaptersInfo GetIpAddrTable

ws2_32

htonl WSACreateEvent WSAResetEvent ntohl WSACloseEvent htons ntohs

wininet

InternetOpenW InternetOpenUrlW InternetCloseHandle HttpQueryInfoW InternetReadFile

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_1d194ff317762c7e6ceb59d48841d9ed_coinminer_elex_rhadamanthys_stealc_stop

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

wintrust

crypt32

rpcrt4

psapi

iphlpapi

ws2_32

wininet

wtsapi32

userenv

generic