2026-08-27_e89763d3792310fcaffcfb0f91e32e54_coinminer_elex_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-27_e89763d3792310fcaffcfb0f91e32e54_coinminer_elex_mespinoza
Size 1.2MB
Sample260828-ds9pmsbf85
SHA256 8cf0a7b624aeceff29661cb5523ac8dec5224934e82e8edad833ea3f76dbd289
MD5 e89763d3792310fcaffcfb0f91e32e54
SHA1 cf23a097aa98f71dab47970257746f4615284190
SHA512 65560f30bc697c9ccdaa48b0b848f1f95170edc2b260bef61c8878d8fe75133ccb60dcd8cc8d5aa3119e6640a6fe42d5cda065d2721bddb1a58aa1c8f4d74c71
SSDEEP 12288:8+7m6ll83KxoPbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:8S83KxosBe5uO3WaufwThsZ
TLSH
T1D65512067948C0A5EB820272D5FCAEF842372D34DB5246D3B2D93E5D38B1DE60D7926A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_e89763d3792310fcaffcfb0f91e32e54_coinminer_elex_mespinoza

File Explorer

2026-08-27_e89763d3792310fcaffcfb0f91e32e54_coinminer_elex_mespinoza

.exe 1.2MB

2026-08-27_e89763d3792310fcaffcfb0f91e32e54_coinminer_elex_mespinoza

IMPHASH 14465025f3ea95865b14e8efd57fc639
SHA256 8cf0a7b624aeceff29661cb5523ac8dec5224934e82e8edad833ea3f76dbd289
MD5 e89763d3792310fcaffcfb0f91e32e54
SHA1 cf23a097aa98f71dab47970257746f4615284190
SHA512 65560f30bc697c9ccdaa48b0b848f1f95170edc2b260bef61c8878d8fe75133ccb60dcd8cc8d5aa3119e6640a6fe42d5cda065d2721bddb1a58aa1c8f4d74c71
SSDEEP 12288:8+7m6ll83KxoPbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:8S83KxosBe5uO3WaufwThsZ
TLSH
T1D65512067948C0A5EB820272D5FCAEF842372D34DB5246D3B2D93E5D38B1DE60D7926A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31141

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\jenkins\workspace\realplayer_loc_25_0_2\converter\rel32\convert.pdb

kernel32

CloseHandle FreeLibrary GetProcAddress LoadLibraryA FindResourceExW LoadResource LockResource SizeofResource GetCurrentProcessId IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleFileNameA SetEnvironmentVariableA GetEnvironmentVariableA DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException FindResourceW GetModuleHandleW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess SetErrorMode

user32

GetSystemMetrics CharNextA

advapi32

RegSetValueA RegSetValueExA RegEnumKeyExA RegSetValueW RegQueryValueW RegQueryValueA RegOpenKeyW RegEnumKeyA RegDeleteValueA RegDeleteKeyA RegCreateKeyW RegCreateKeyA RegQueryValueExA RegOpenKeyExA RegOpenKeyA RegCloseKey

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

vcruntime140

__vcrt_InitializeCriticalSectionEx memmove strstr _CxxThrowException _purecall __std_exception_destroy strchr strrchr memset memcpy __std_exception_copy _except_handler4_common __telemetry_main_return_trigger __telemetry_main_invoke_trigger

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit _cexit __p___argc __p___wargv _c_exit _register_thread_local_exe_atexit_callback _crt_atexit terminate _controlfp_s _register_onexit_function _set_app_type _errno _invalid_parameter_noinfo _initialize_onexit_table

api-ms-win-crt-string-l1-1-0

wmemcpy_s strncpy wcsnlen _stricmp

api-ms-win-crt-heap-l1-1-0

realloc free malloc _callnewh _set_new_mode

api-ms-win-crt-environment-l1-1-0

getenv _putenv

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __p__commode __stdio_common_vswprintf_s __stdio_common_vswprintf _set_fmode __stdio_common_vsprintf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-multibyte-l1-1-0

_ismbblead

api-ms-win-crt-math-l1-1-0

__setusermatherr

Name

.text

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-27_e89763d3792310fcaffcfb0f91e32e54_coinminer_elex_mespinoza

kernel32

user32

advapi32

version

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-math-l1-1-0

generic