2026-08-15_526e4821f00b46a053309af26869ded6_coinminer_elex_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_526e4821f00b46a053309af26869ded6_coinminer_elex_stop
Size 32.8MB
Sample260815-ehrazsem7x
SHA256 c3d8cf053c8dd8915c51e99398bb85c92363cbc56c51d2350c7b2199ccf4f0eb
MD5 526e4821f00b46a053309af26869ded6
SHA1 1efd430d231f9c010231018b9f6134117005594a
SHA512 91019dcf4552ecae93835e6602b04fa66f22e6a39810ef64243af383c96d3eefec7863e1ffa63183a4976d36ca47609135ae757ca0165a90bdc930636015df85
SSDEEP 98304:4WT8Tixr3XMu3OSzRTqmPWgCPQHXL48j5XRmtaIj2HxPCy8DmUGqJ7IK:4W4Wxr5zR3qSj5XHxPX8vhT
TLSH
T14F77D142F782813ACE4A15719417933F52686BE52B34E5C7FFE42E292F319E2993134E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_526e4821f00b46a053309af26869ded6_coinminer_elex_stop

File Explorer

2026-08-15_526e4821f00b46a053309af26869ded6_coinminer_elex_stop

.exe 32.8MB

2026-08-15_526e4821f00b46a053309af26869ded6_coinminer_elex_stop

IMPHASH 964e6ca3b4a419e39c43b08ba7ab0aca
SHA256 c3d8cf053c8dd8915c51e99398bb85c92363cbc56c51d2350c7b2199ccf4f0eb
MD5 526e4821f00b46a053309af26869ded6
SHA1 1efd430d231f9c010231018b9f6134117005594a
SHA512 91019dcf4552ecae93835e6602b04fa66f22e6a39810ef64243af383c96d3eefec7863e1ffa63183a4976d36ca47609135ae757ca0165a90bdc930636015df85
SSDEEP 98304:4WT8Tixr3XMu3OSzRTqmPWgCPQHXL48j5XRmtaIj2HxPCy8DmUGqJ7IK:4W4Wxr5zR3qSj5XHxPX8vhT
TLSH
T14F77D142F782813ACE4A15719417933F52686BE52B34E5C7FFE42E292F319E2993134E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41331237

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegOpenKeyA RegEnumValueA RegEnumKeyA RegCloseKey RegQueryValueExA RegOpenKeyExA RegSetValueExA RegSetValueA RegCreateKeyA RegDeleteKeyA RegDeleteValueA RegCreateKeyExA RegQueryInfoKeyA RegEnumKeyExA GetUserNameA

comdlg32

GetSaveFileNameA GetOpenFileNameA

ddraw

DirectDrawCreate

dinput8

DirectInput8Create

dsound

DirectSoundCreate8

gdi32

GetCharacterPlacementA GetCharacterPlacementW GetGlyphOutline GetTextMetricsA GetObjectW GetTextMetricsW GetFontLanguageInfo CreateFontIndirectA CreateFontIndirectW SetTextAlign ExtTextOutA MoveToEx ExtTextOutW SetBkMode CreateDIBSection SetMapMode SetTextColor SetBkColor CreateFontA GetDIBits GetDeviceGammaRamp SetDeviceGammaRamp GetStockObject GetObjectA CreateSolidBrush BitBlt CreateCompatibleBitmap DeleteObject GetDeviceCaps CreateDCA CreateCompatibleDC SelectObject GetTextExtentPoint32A DeleteDC

imm32

ImmReleaseContext ImmGetContext ImmGetIMEFileNameA ImmGetOpenStatus ImmGetConversionStatus ImmIsIME ImmSetConversionStatus ImmAssociateContext ImmSetCompositionWindow ImmGetProperty ImmGetCompositionStringW ImmGetCandidateListW ImmNotifyIME

kernel32

FileTimeToSystemTime CompareStringA GetLocaleInfoA GetSystemDirectoryA CreateDirectoryA SetCurrentDirectoryA WaitForSingleObjectEx CreateThread GetUserDefaultLangID GetUserDefaultUILanguage EnumResourceLanguagesA GetComputerNameA LocalFree FormatMessageA GetCommandLineA GetPrivateProfileIntA SetUnhandledExceptionFilter GetCurrentProcessId IsBadReadPtr CopyFileA GetVersion lstrlen lstrcpy CloseHandle CreateFileA UnmapViewOfFile CreateFileMappingA GetFileSize MapViewOfFile IsProcessorFeaturePresent InterlockedCompareExchange CompareStringW GetLocaleInfoW GetProcessHeap SetEndOfFile IsValidLocale EnumSystemLocalesA GetUserDefaultLCID WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA FlushFileBuffers VirtualFree HeapCreate GetTimeZoneInformation LCMapStringW LCMapStringA PeekNamedPipe GetFileInformationByHandle InitializeCriticalSectionAndSpinCount InterlockedExchange CreateFileW GetStdHandle LockResource GetFileType SetStdHandle IsValidCodePage GetOEMCP GetACP LoadLibraryExA HeapSize TlsFree TlsSetValue TlsAlloc TlsGetValue IsDebuggerPresent SetEnvironmentVariableA GetConsoleMode GetConsoleCP WriteFile UnhandledExceptionFilter HeapReAlloc GetStartupInfoA GetSystemInfo VirtualAlloc VirtualProtect HeapAlloc GetDateFormatA GetTimeFormatA ExitThread HeapFree GetSystemTimeAsFileTime ReadFile MoveFileA GetDriveTypeA FileTimeToLocalFileTime ExitProcess SetFilePointer RtlUnwind GetFullPathNameA QueryPerformanceCounter QueryPerformanceFrequency FindResourceA LoadResource SizeofResource SetLastError GetCurrentThreadId GlobalAlloc GlobalLock RaiseException OutputDebugStringA WaitForSingleObject CreateEventA SetEvent LeaveCriticalSection EnterCriticalSection GetLocalTime WritePrivateProfileStringA DeleteCriticalSection InitializeCriticalSection GetTickCount GetModuleHandleW CreateMutexA GetLastError Sleep OpenProcess TerminateProcess DeleteFileA CreateProcessA GetCurrentDirectoryA WinExec FindFirstFileA FindNextFileA FindClose RemoveDirectoryA IsDBCSLeadByteEx IsDBCSLeadByte VirtualQuery GetVersionExA GlobalMemoryStatus GetPrivateProfileStringA GetModuleHandleA GetFileAttributesA GetModuleFileNameA LoadLibraryA GetProcAddress FreeLibrary WideCharToMultiByte MultiByteToWideChar GlobalUnlock MulDiv lstrcmp GetCurrentProcess FlushInstructionCache lstrcmpi InterlockedDecrement InterlockedIncrement GetCPInfo lstrlenW VirtualProtect Sleep

nps

OpenSurveyW

oleaut32

VarUI4FromStr SafeArrayUnaccessData SafeArrayCreateVector SafeArrayAccessData LoadTypeLib LoadRegTypeLib SystemTimeToVariantTime SysStringLen SysFreeString VariantInit VariantClear SysAllocStringLen SysAllocString OleCreateFontIndirect

shell32

SHGetSpecialFolderPathA SHGetPathFromIDList SHBrowseForFolder

user32

GetWindowRect MoveWindow DestroyWindow PostQuitMessage DefWindowProcA ShowWindow MessageBoxA PostMessageA MessageBoxW wsprintfA UnregisterClassA DefWindowProcW PeekMessageA TranslateMessage GetWindow DialogBoxIndirectParamA SendDlgItemMessageA ChangeDisplaySettingsA LoadStringA EnumDisplayMonitors GetMonitorInfoA SetCursor GetSystemMetrics SetFocus GetDlgItem EndDialog CreateWindowExA RegisterClassExA LoadCursorA LoadIconA GetMessageA UpdateWindow GetWindowThreadProcessId FindWindowA CreateWindowExW RegisterClassExW LoadCursorW GetKeyboardLayout ShowCursor SetCursorPos PtInRect RegisterClipboardFormatA GetWindowTextLengthA GetWindowTextA SetWindowTextA CreateAcceleratorTableA GetClassInfoExA IsWindow GetDesktopWindow GetFocus LoadIconW DestroyAcceleratorTable BeginPaint EndPaint CallWindowProcA FillRect ReleaseCapture GetClassNameA GetParent IsChild SetCapture RedrawWindow InvalidateRgn InvalidateRect ReleaseDC GetDC ClientToScreen GetClientRect GetSysColor CharNextA GetWindowLongA SetWindowLongA SendMessageA GetCursorPos ScreenToClient SetWindowPos SetRectEmpty SetRect GetAsyncKeyState PeekMessageW DispatchMessageW UnregisterClassW DispatchMessageA

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

winmm

timeGetTime

ws2_32

closesocket WSAGetLastError inet_addr setsockopt connect WSAAsyncSelect recv WSAStartup htons send socket

d3d9

Direct3DCreate9

ijl15

ijlInit ijlWrite ijlFree

ole32

CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance CoTaskMemFree StringFromGUID2 OleLockRunning CoInitialize CoUninitialize OleUninitialize OleInitialize CreateStreamOnHGlobal CLSIDFromString CLSIDFromProgID CoGetClassObject

Name

Size

31.0MB

Virtual Size

31.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

66KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Tut4you

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

952KB

Virtual Size

952KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

xjuorffg

Size

780KB

Virtual Size

780KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

brxdckco

Size

4KB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PE_ADS

Size

42KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dlib

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=12, id=95, version=2067,

count=6, id=18, version=8444,

count=2, id=221, productName=VS2013 build 21005, version=21005,

count=7, id=150, version=20413,

count=65, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=109, productName=VS2005 build 50727, version=50727,

count=231, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=25, version=9210,

count=2, id=28, version=9178,

count=127, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=24, id=123, productName=VS2005 build 50727, version=50727,

count=378, id=1, productName=Unmarked objects,

count=78, id=10, version=8966,

count=7, id=138, version=30729,

count=6, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=453, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,