2026-08-08_ff5f6687d72fcfd248872038649a80f3_coinminer_elex_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_ff5f6687d72fcfd248872038649a80f3_coinminer_elex_stop
Size 29.4MB
Sample260808-vh45vaee38
SHA256 5ae02396d0cea5f46ccdf03cba7d774391526810c8b9a43acce686a50326191a
MD5 ff5f6687d72fcfd248872038649a80f3
SHA1 acf3ec4a57a34485eb7ade45b5034b1c38e007f0
SHA512 a88314f8cf0a810d0ec97bb5785130550e3bb3cba57118800d4536e9524f9fc51adf7eb4a171ccc1a9b502f9c8a18cdbbba6b3b13b6ef28800f40bd169585c62
SSDEEP 786432:21qd8TBc++AtEGmgXEDq4G67OEVAIOoYdkvQgS:Ldn++AtzmgQqPqOEWIOoQoy
TLSH
T1306733137BE0D172D3A9847126D197BE627AAEC746308483E74DBB5E8664E807F33B05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-08_ff5f6687d72fcfd248872038649a80f3_coinminer_elex_stop

.exe 29.4MB

2026-08-08_ff5f6687d72fcfd248872038649a80f3_coinminer_elex_stop

IMPHASH ecf54feed661d10b73495be721ca7a32
SHA256 5ae02396d0cea5f46ccdf03cba7d774391526810c8b9a43acce686a50326191a
MD5 ff5f6687d72fcfd248872038649a80f3
SHA1 acf3ec4a57a34485eb7ade45b5034b1c38e007f0
SHA512 a88314f8cf0a810d0ec97bb5785130550e3bb3cba57118800d4536e9524f9fc51adf7eb4a171ccc1a9b502f9c8a18cdbbba6b3b13b6ef28800f40bd169585c62
SSDEEP 786432:21qd8TBc++AtEGmgXEDq4G67OEVAIOoYdkvQgS:Ldn++AtzmgQqPqOEWIOoQoy
TLSH
T1306733137BE0D172D3A9847126D197BE627AAEC746308483E74DBB5E8664E807F33B05
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

5a:de:fa:07:55:21:4c:d4:87:86:fd:07:83:92:f1:aa:eb:93:0f:ca:ff:f3:05:24:ae:fb:79:1a:59:b3:12:c9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=沈阳元微科技有限公司,O=沈阳元微科技有限公司,L=沈阳市,ST=辽宁省,C=CN

Chains

Jul 9, 2026

CN=沈阳元微科技有限公司,O=沈阳元微科技有限公司,L=沈阳市,ST=辽宁省,C=CN

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=沈阳元微科技有限公司,O=沈阳元微科技有限公司,L=沈阳市,ST=辽宁省,C=CN

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=沈阳元微科技有限公司,O=沈阳元微科技有限公司,L=沈阳市,ST=辽宁省,C=CN

Serial Number

6d:91:c7:36:f2:b6:e6:1e:8e:12:5b:a9:d3:6f:28:32

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 17, 2025 - Dec 16, 2028

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Minor OS version

Major OS version

Entry point

589424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

g:\jekins_work\workspace\lenovo_zip_build\product\win32\dbginfo\installer.pdb

imm32

ImmDisableIME

kernel32

FileTimeToLocalFileTime GetStdHandle WaitForMultipleObjects VirtualFree VirtualAlloc SetEvent ReleaseSemaphore ResetEvent CreateSemaphoreW CreateEventW lstrcpyW GetWindowsDirectoryW SetFileAttributesW GetComputerNameA GetDiskFreeSpaceExW CreateFileA CreateProcessW GetCommandLineW GetCurrentProcessId FreeResource FlushInstructionCache GetPrivateProfileStringW GetPrivateProfileIntW InterlockedExchange RaiseException InterlockedIncrement GetCurrentThreadId InterlockedDecrement lstrcmpiW OutputDebugStringW GlobalAlloc GlobalLock GlobalFree GlobalUnlock GetDriveTypeW MapViewOfFileEx LoadLibraryExW SetThreadPriority SleepEx DuplicateHandle ReleaseMutex CreateMutexW GetExitCodeThread FormatMessageW InitializeCriticalSectionAndSpinCount SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA GetCurrentDirectoryA GetFullPathNameA QueryPerformanceCounter GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP GetTimeZoneInformation HeapCreate GetModuleFileNameA TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetStartupInfoA SetHandleCount LCMapStringW LCMapStringA GetCPInfo RtlUnwind FindFirstFileA GetDriveTypeA GetStartupInfoW ExitProcess VirtualQuery GetModuleHandleA VirtualProtect ExitThread GetFileType SetStdHandle IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent LoadLibraryA GetThreadLocale GetLocaleInfoA GetACP GetVersionExA GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy FindResourceW SizeofResource LockResource LoadResource FindResourceExW GetLastError CreateDirectoryW FindClose RemoveDirectoryW GetModuleFileNameW GetFileAttributesW DeleteFileW CreateFileW CloseHandle WriteFile lstrlenW WideCharToMultiByte GetFileSize ReadFile GetLocalTime SetFilePointer GetSystemTimeAsFileTime FileTimeToSystemTime SetEndOfFile FlushFileBuffers GetCurrentDirectoryW CreateFileMappingW UnmapViewOfFile MapViewOfFile GetTickCount GetTempFileNameW CopyFileW GetTempPathW MoveFileW MoveFileExW SetLastError SetCurrentDirectoryW InterlockedCompareExchange GetSystemInfo LocalFree LocalAlloc GetVersionExW GetSystemDirectoryW DeleteCriticalSection GetCurrentProcess InitializeCriticalSection FreeLibrary GetProcAddress LoadLibraryW OpenProcess LeaveCriticalSection EnterCriticalSection Sleep QueryDosDeviceW WaitForSingleObject GetLogicalDriveStringsW CreateThread TerminateThread TerminateProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot GetModuleHandleW ExpandEnvironmentStringsW MultiByteToWideChar lstrlenA

user32

GetForegroundWindow IsWindowEnabled EnableWindow GetDlgItem IntersectRect GetCursorPos ScreenToClient ClientToScreen LoadBitmapW SetWindowRgn GetWindowThreadProcessId CharLowerW CharUpperW GetDesktopWindow UpdateLayeredWindow GetActiveWindow InvalidateRect DestroyIcon CallWindowProcW DrawTextW IsWindowVisible LoadIconW SetCursor SetWindowTextW GetWindowTextW SetRectEmpty SystemParametersInfoW SendMessageW KillTimer MoveWindow AttachThreadInput RegisterWindowMessageW DestroyWindow SetForegroundWindow GetWindowTextLengthW CharNextW LoadStringW SetActiveWindow PostMessageW IsIconic SetFocus GetWindow IsRectEmpty GetWindowLongW DrawIconEx GetClientRect GetNextDlgTabItem SetRect MapWindowPoints SetTimer FindWindowW PeekMessageW GetMessageW TranslateMessage InflateRect DispatchMessageW CopyRect SetCapture MonitorFromWindow GetMonitorInfoW LoadImageW GetDC CreateWindowExW GetDlgCtrlID EndPaint GetKeyState ReleaseCapture BeginPaint WindowFromPoint GetScrollPos DefWindowProcW OffsetRect GetFocus LoadCursorW IsChild SetWindowLongW RegisterClassExW UnregisterClassA ReleaseDC ShowWindow PtInRect EqualRect IsDialogMessageW IsWindow GetParent PostThreadMessageW SetWindowPos GetClassInfoExW GetWindowRect

gdi32

DeleteObject GetStockObject GetTextMetricsW SetStretchBltMode CreateRoundRectRgn OffsetRgn ExtSelectClipRgn SetViewportOrgEx GetViewportOrgEx CombineRgn CreateDIBSection CreateRectRgn SelectClipRgn GetObjectW SetBkMode StretchBlt BitBlt DeleteDC ExtTextOutW SetBkColor SelectObject CreateCompatibleDC RectInRegion CreateRectRgnIndirect GetTextExtentPoint32W GetDeviceCaps TextOutW RoundRect LineTo Rectangle MoveToEx CreatePen GetClipRgn GetTextColor RestoreDC SetTextColor SaveDC CreateBitmap GetCurrentObject CreateCompatibleBitmap CreateFontIndirectW

advapi32

RegOpenKeyW RegOpenKeyExW RegCloseKey RegQueryValueExW ControlService StartServiceW QueryServiceStatus DeleteService ChangeServiceConfig2W ChangeServiceConfigW OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW RegQueryInfoKeyW RegDeleteValueW SetNamedSecurityInfoW SetEntriesInAclW BuildExplicitAccessWithNameW DeleteAce GetAce CreateProcessAsUserW GetNamedSecurityInfoW RegEnumKeyExW RegDeleteKeyW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetTokenInformation DuplicateTokenEx FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation RegSetValueExW OpenProcessToken RegCreateKeyExW

shell32

SHGetMalloc SHGetPathFromIDListW SHBrowseForFolderW SHGetSpecialFolderLocation SHFileOperationW SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteW

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CreateStreamOnHGlobal CoInitializeEx CoUninitialize CoCreateInstance CoInitialize CoCreateGuid

oleaut32

VariantCopy VariantClear SysFreeString VarUI4FromStr SysStringLen SysAllocString

shlwapi

StrToIntW StrToIntA PathAddBackslashW PathAppendW PathRemoveFileSpecW PathFileExistsW PathFindFileNameW PathIsDirectoryW

comctl32

InitCommonControlsEx _TrackMouseEvent

msimg32

AlphaBlend

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory

gdiplus

GdipScaleWorldTransform GdipDrawImageRectI GdipGetFamily GdipGetFontSize GdipDrawLine GdipCreateLineBrushFromRectWithAngleI GdipSetPenDashStyle GdipAddPathStringI GdipDrawRectangleI GdipDrawPath GdipGraphicsClear GdipFillRectangle GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipSetPenStartCap GdipSetPenEndCap GdipDrawImagePointsRectI GdipLoadImageFromStream GdipGetImagePixelFormat GdipImageRotateFlip GdipCreateBitmapFromStream GdipCreateHBITMAPFromBitmap GdipCloneBitmapArea GdipDrawImageRectRectI GdipSetStringFormatTrimming GdipDeletePen GdipCreateSolidFill GdipDrawImageRectRect GdipCreatePen1 GdipPrivateAddFontFile GdipDeletePrivateFontCollection GdipCloneBrush GdipNewPrivateFontCollection GdipDeleteBrush GdipRotateWorldTransform GdipDrawImageI GdipSetStringFormatAlign GdipTranslateWorldTransform GdipCloneFontFamily GdipSetStringFormatFlags GdipGetFontCollectionFamilyList GdipMeasureString GdipResetWorldTransform GdipDeleteStringFormat GdipGetFontCollectionFamilyCount GdipDrawString GdipAddPathRectangleI GdipCreateStringFormat GdipSetSmoothingMode GdipGetImageHeight GdipGetImageWidth GdipSetTextRenderingHint GdipFillRectangleI GdiplusShutdown GdiplusStartup GdipCloneImage GdipDeleteGraphics GdipLoadImageFromFile GdipCreateFromHDC GdipDisposeImage GdipSetImageAttributesColorMatrix GdipClosePathFigure GdipSetClipPath GdipDeleteFont GdipDisposeImageAttributes GdipAlloc GdipCreateImageAttributes GdipFree GdipCreateFont GdipDeletePath GdipCreateFontFromLogfontW GdipCreatePath GdipSetPixelOffsetMode GdipSetInterpolationMode GdipSetPenMode GdipAddPathArcI GdipSetCompositingQuality GdipFillPath GdipDrawLinesI GdipAddPathPieI GdipDeleteFontFamily GdipSetStringFormatLineAlign

??0?$_CallBack@VKSimpleDirectInfoc@@@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAE@ABU012@@Z ??0?$_CallBack@VKSimpleDirectInfoc@@@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAE@XZ ??0?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAE@XZ ??0?$kxThreadBase@VLocker@kbase@@@kbase@@QAE@XZ ??0ReportHelper@business_publish@@AAE@XZ ??1?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@UAE@XZ ??1?$kxThreadBase@VLocker@kbase@@@kbase@@UAE@XZ ??1ReportHelper@business_publish@@UAE@XZ ??4?$_CallBack@VKSimpleDirectInfoc@@@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAEAAU012@ABU012@@Z ??_7?$_CallBack@VKSimpleDirectInfoc@@@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@6B@ ??_7?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@6B@ ??_7?$kxThreadBase@VLocker@kbase@@@kbase@@6B@ ??_7ReportHelper@business_publish@@6B?$_CallBack@VKSimpleDirectInfoc@@@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@@ ??_7ReportHelper@business_publish@@6B?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@@ ?AddItem@ReportHelper@business_publish@@QAEHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0AAV?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@@2@@4@@Z ?AddItem@ReportHelper@business_publish@@QAEHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@HAAV?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@@2@@4@@Z ?AfterThreadFun@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@MAEXH@Z ?AfterThreadFun@?$kxThreadBase@VLocker@kbase@@@kbase@@MAEXH@Z ?BeginThreadFun@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@MAEXXZ ?BeginThreadFun@?$kxThreadBase@VLocker@kbase@@@kbase@@MAEXXZ ?GetHandle@?$kxThreadBase@VLocker@kbase@@@kbase@@QBEPAXXZ ?GetInstance@ReportHelper@business_publish@@SAPAV12@XZ ?Init@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAEXPAU?$_CallBack@VKSimpleDirectInfoc@@@12@K@Z ?Initialzie@ReportHelper@business_publish@@QAE_NW4ReportType@2@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?Insert@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAE_NABVKSimpleDirectInfoc@@@Z ?IsRunning@?$kxThreadBase@VLocker@kbase@@@kbase@@QAE_NXZ ?KCreateThread@?$kxThreadBase@VLocker@kbase@@@kbase@@SAPAXHP6GKPAX@Z0PAK0II@Z ?Kill@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@UAEHXZ ?Kill@?$kxThreadBase@VLocker@kbase@@@kbase@@UAEHXZ ?QueueThreadCallback@ReportHelper@business_publish@@MAEHKAAVKSimpleDirectInfoc@@@Z ?Report@ReportHelper@business_publish@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@@2@@4@PBV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@4@@Z ?ReportDirect@ReportHelper@business_publish@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@@2@@4@PBV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@4@@Z ?SetPriority@?$kxThreadBase@VLocker@kbase@@@kbase@@QAEHH@Z ?SetTimeOut@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAEXK@Z ?Start@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAEHXZ ?StartThread@?$kxThreadBase@VLocker@kbase@@@kbase@@IAEHPAX@Z ?Thread@?$kxThreadBase@VLocker@kbase@@@kbase@@AAEIPAX@Z ?Uninitialize@ReportHelper@business_publish@@QAEXXZ ?WaitKill@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@UAEHK@Z ?WaitKill@?$kxThreadBase@VLocker@kbase@@@kbase@@UAEHK@Z ?size@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAEIXZ ?threadFun@?$kxThreadBase@VLocker@kbase@@@kbase@@CGIPAX@Z ?threadFunImpl@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@MAEHKPAX@Z

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_ff5f6687d72fcfd248872038649a80f3_coinminer_elex_stop

imm32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

version

wtsapi32

gdiplus

generic