2026-08-09_40afe0f92cdad9ed72eabb0e2f59fc9c_coinminer_elex_floxif_rhadamanthys_stop

General

Target
2026-08-09_40afe0f92cdad9ed72eabb0e2f59fc9c_coinminer_elex_floxif_rhadamanthys_stop
Size 1.8MB
Sample260809-gbb9la1fpa
SHA256 7ea250cfaab78d0d77939e3a53376c503817224668e290b39402feb6f5b2edc8
MD5 40afe0f92cdad9ed72eabb0e2f59fc9c
SHA1 a7af2f9c5a8514595c57b45b3a7db7a02877451d
SHA512 fd30b24df2cbc28568216e606c4b02fda4fe6d3b05529ee05f38f759543395a52f8399deb1fe67e798c8382597d910ad8028771a05402b51cddc5c45c33f0121
SSDEEP 24576:gc3/TOMs8RVFXqqeJACeSilGdqj/j5QP1euFmVBR2Z+AZxRziSJrEH7hw:93LW8RVtAAC+gq/BUZHiSJ
TLSH
T18D85234276208BF0E4280233744E9A918BEAEC3E4DB957132FC9755F9B7D5638627F06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_40afe0f92cdad9ed72eabb0e2f59fc9c_coinminer_elex_floxif_rhadamanthys_stop

File Explorer

2026-08-09_40afe0f92cdad9ed72eabb0e2f59fc9c_coinminer_elex_floxif_rhadamanthys_stop

.exe 1.8MB

2026-08-09_40afe0f92cdad9ed72eabb0e2f59fc9c_coinminer_elex_floxif_rhadamanthys_stop

IMPHASH d2c82993d1a616abe994cabd5db7b4f8
SHA256 7ea250cfaab78d0d77939e3a53376c503817224668e290b39402feb6f5b2edc8
MD5 40afe0f92cdad9ed72eabb0e2f59fc9c
SHA1 a7af2f9c5a8514595c57b45b3a7db7a02877451d
SHA512 fd30b24df2cbc28568216e606c4b02fda4fe6d3b05529ee05f38f759543395a52f8399deb1fe67e798c8382597d910ad8028771a05402b51cddc5c45c33f0121
SSDEEP 24576:gc3/TOMs8RVFXqqeJACeSilGdqj/j5QP1euFmVBR2Z+AZxRziSJrEH7hw:93LW8RVtAAC+gq/BUZHiSJ
TLSH
T18D85234276208BF0E4280233744E9A918BEAEC3E4DB957132FC9755F9B7D5638627F06
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetUnhandledExceptionFilter lstrcmpiA lstrcpyA lstrlenA _lclose GetModuleFileNameA _lread _llseek _lopen _lwrite _lcreat CreateDirectoryA SetCurrentDirectoryA lstrcatA FreeLibrary GetProcAddress LoadLibraryA GetDiskFreeSpaceA UnhandledExceptionFilter RemoveDirectoryA DeleteFileA GetTempPathA GetCurrentDirectoryA CloseHandle GetExitCodeProcess LocalFree Sleep HeapSize RtlUnwind LCMapStringW LCMapStringA GetStringTypeW GetCurrentProcess GetFileAttributesA TerminateProcess MultiByteToWideChar GetStringTypeA GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetLastError InterlockedDecrement ExitProcess HeapFree HeapAlloc GetCommandLineA GetVersionExA GetProcessHeap GetStartupInfoA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage WriteFile GetStdHandle InitializeCriticalSection HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoA

user32

TranslateMessage DispatchMessageA PeekMessageA wsprintfA LoadCursorA SetCursor MessageBoxA MsgWaitForMultipleObjects

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_40afe0f92cdad9ed72eabb0e2f59fc9c_coinminer_elex_floxif_rhadamanthys_stop

kernel32

user32

advapi32

shell32

generic