2026-08-27_dee59250bf8c9d5aa8c8bf5019fa9f1b_coinminer_elex_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-27_dee59250bf8c9d5aa8c8bf5019fa9f1b_coinminer_elex_mespinoza
Size 1.7MB
Sample260828-eynj2aep9v
SHA256 71bcd6e988f8680dfe807b132cf8f65613fad9d0bb3c97085013971bf2d884f9
MD5 dee59250bf8c9d5aa8c8bf5019fa9f1b
SHA1 e1bd7354fb9a4d0ad04729f7085b517e7340a82e
SHA512 3564bb662b049865dcfcbacf4e8bf7802878c58153d3c51de8cffd0ce126aba06a6a086795820649fdd4683f6e6d11fdb717cf1b841f39dcde95b02e0c3c985d
SSDEEP 24576:U0NzWAEb8/fEj+jisT+6bP/vOZQ2RugsBe5uO3WaufwThsZ:dWMn0+ji2v3TkJu4G
TLSH
T18585CE11B5C1C035E6A300B2FEBCAAB860A93D61E72601DB72C97F0D7E71AD14A35767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_dee59250bf8c9d5aa8c8bf5019fa9f1b_coinminer_elex_mespinoza

File Explorer

2026-08-27_dee59250bf8c9d5aa8c8bf5019fa9f1b_coinminer_elex_mespinoza

.exe 1.7MB

2026-08-27_dee59250bf8c9d5aa8c8bf5019fa9f1b_coinminer_elex_mespinoza

IMPHASH 43b37f33ff4f745850c8551bb10d3148
SHA256 71bcd6e988f8680dfe807b132cf8f65613fad9d0bb3c97085013971bf2d884f9
MD5 dee59250bf8c9d5aa8c8bf5019fa9f1b
SHA1 e1bd7354fb9a4d0ad04729f7085b517e7340a82e
SHA512 3564bb662b049865dcfcbacf4e8bf7802878c58153d3c51de8cffd0ce126aba06a6a086795820649fdd4683f6e6d11fdb717cf1b841f39dcde95b02e0c3c985d
SSDEEP 24576:U0NzWAEb8/fEj+jisT+6bP/vOZQ2RugsBe5uO3WaufwThsZ:dWMn0+ji2v3TkJu4G
TLSH
T18585CE11B5C1C035E6A300B2FEBCAAB860A93D61E72601DB72C97F0D7E71AD14A35767
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

250775

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\jenkins\workspace\realplayer_loc_25_0_2\rpbgrecorder\rel32\recordingmanager.pdb

ole32

CoCreateInstance CoTaskMemFree CoInitialize CoUninitialize

kernel32

GetThreadContext GlobalMemoryStatusEx VirtualQuery Process32First Process32Next Thread32First Thread32Next Module32First Module32Next K32GetProcessMemoryInfo GetModuleHandleExA SetProcessWorkingSetSize SetLastError CreateEventA WaitForMultipleObjects OpenThread CreateProcessA OpenFileMappingW GetCommandLineW SetEvent DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc SetFilePointer GetCurrentProcessId SetEnvironmentVariableA GetEnvironmentVariableA OpenMutexW CreateMutexW SetProcessPreferredUILanguages GetLocaleInfoW LoadLibraryW IsBadWritePtr IsBadReadPtr VirtualProtect TerminateThread CreateThread SetUnhandledExceptionFilter GetCurrentDirectoryA SetCurrentDirectoryA GetSystemDirectoryW MoveFileA LoadLibraryA GetModuleFileNameA FreeLibrary CreateFileMappingA LoadLibraryExW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent IsDebuggerPresent CloseHandle RaiseException GetLastError HeapDestroy HeapAlloc DeleteFileA CreateFileA CreateToolhelp32Snapshot GetProcAddress GetModuleFileNameW UnmapViewOfFile MapViewOfFile GetCurrentThreadId GetCurrentProcess SetErrorMode WriteFile GetFileAttributesW CreateDirectoryW OutputDebugStringW CreateProcessW TerminateProcess Sleep WaitForSingleObject GetTempPathW GetTempFileNameW CreateFileW CopyFileW LeaveCriticalSection EnterCriticalSection DeleteFileW WideCharToMultiByte MultiByteToWideChar LocalFree FindResourceW SizeofResource LockResource LoadResource GetModuleHandleW GetModuleHandleA FindResourceExW GetTickCount OpenEventW CreateEventW CreateMutexA ReleaseMutex

user32

CharPrevA GetSystemMetrics CharNextA RegisterWindowMessageA GetMessageA TranslateMessage DispatchMessageA SendMessageA PostMessageA DefWindowProcA PostQuitMessage RegisterClassExA CreateWindowExA ShowWindow UpdateWindow BeginPaint EndPaint FindWindowA FindWindowW LoadCursorA IsWindow DestroyMenu GetSubMenu SetMenuDefaultItem SetPropW MessageBoxA DestroyIcon UnregisterClassW SetWindowPos IsIconic GetDC LoadIconA SetLastErrorEx ReleaseDC SendMessageTimeoutA DestroyWindow EnumWindows LoadMenuA GetWindowPlacement GetPropW

advapi32

RegSetValueExA RegGetValueW RegCloseKey RegOpenKeyExW RegQueryValueExW RegOpenKeyA RegOpenKeyExA RegQueryValueExA RegCreateKeyA RegCreateKeyW RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegOpenKeyW RegQueryValueA FreeSid RegQueryValueW RegEnumKeyExA RegSetValueW RegSetValueA

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

gdi32

GetDeviceCaps

msvcp140

?exceptions@ios_base@std@@QAEXH@Z ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@PAV32@@Z ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z _Getcoll _Strcoll _Strxfrm _Wcscoll _Wcsxfrm ??0_Locinfo@std@@QAE@PBD@Z ??1_Locinfo@std@@QAE@XZ ??Bid@locale@std@@QAEIXZ ??0facet@locale@std@@IAE@I@Z ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?tolower@?$ctype@D@std@@QBEDD@Z ?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?is@?$ctype@_W@std@@QBE_NF_W@Z ?tolower@?$ctype@_W@std@@QBE_W_W@Z ?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?_BADOFF@std@@3_JB ??_7_Facet_base@std@@6B@ ??_7facet@locale@std@@6B@ ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$ctype@_W@std@@2V0locale@2@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ??_7ios_base@std@@6B@ ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ?id@?$collate@D@std@@2V0locale@2@A ?id@?$collate@_W@std@@2V0locale@2@A ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@ ?getloc@ios_base@std@@QBE?AVlocale@2@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@N@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?widen@?$ctype@_W@std@@QBE_WD@Z

shell32

SHCreateDirectoryExA SHGetKnownFolderPath SHCreateDirectoryExW ShellExecuteW ShellExecuteA CommandLineToArgvW SHGetFolderPathW

oleaut32

VariantInit VariantClear SysFreeString SysAllocStringLen

shlwapi

PathFindFileNameA PathStripPathW PathRemoveExtensionW PathCombineW PathAddBackslashW PathRemoveFileSpecW PathFileExistsW PathAppendW

vcruntime140

_except_handler4_common __telemetry_main_return_trigger __telemetry_main_invoke_trigger __vcrt_InitializeCriticalSectionEx __std_type_info_compare wcschr strstr wcsrchr _purecall memset memcpy __CxxFrameHandler3 _CxxThrowException __std_exception_destroy __std_exception_copy wcsstr strchr memmove memchr strrchr

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _invalid_parameter_noinfo _errno _controlfp_s terminate _register_thread_local_exe_atexit_callback _c_exit _exit exit _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _initterm_e _get_narrow_winmain_command_line _initterm _configure_narrow_argv

api-ms-win-crt-heap-l1-1-0

_recalloc free realloc _callnewh _set_new_mode calloc malloc

api-ms-win-crt-convert-l1-1-0

atoi _wtol _wtoi strtol atol _atoi64

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-stdio-l1-1-0

setvbuf fwrite _set_fmode __stdio_common_vsprintf _wfopen __p__commode __stdio_common_vsnwprintf_s _fseeki64 ftell fsetpos __stdio_common_vfprintf fseek __acrt_iob_func fread fgetpos fputc ungetc __stdio_common_vswprintf __stdio_common_vswprintf_s fgetc _get_stream_buffer_pointers fclose fflush

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-string-l1-1-0

iswprint isspace isdigit wcsnlen _wcsicmp iswspace wmemcpy_s wcsncpy_s _stricmp strtok strncpy strncat wcscspn wcsspn _wcslwr_s strnlen tolower _strnicmp

api-ms-win-crt-time-l1-1-0

_time32 _gmtime32 asctime _time64

api-ms-win-crt-environment-l1-1-0

_putenv getenv

api-ms-win-crt-multibyte-l1-1-0

_mbsinc _mbslwr_s _mbsstr _mbsspn _mbschr _mbscmp _mbscspn _ismbblead

api-ms-win-crt-math-l1-1-0

_libm_sse2_pow_precise _except1 __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

cpprest140_2_8

?at@value@json@web@@QAEAAV123@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?as_string@value@json@web@@QBEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?parse@value@json@web@@SA?AV123@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?type@value@json@web@@QBE?AW4value_type@123@XZ ??4value@json@web@@QAEAAV012@$$QAV012@@Z ??4value@json@web@@QAEAAV012@ABV012@@Z ??0value@json@web@@QAE@H@Z ??0value@json@web@@QAE@XZ

Name

.text

Size

268KB

Virtual Size

267KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

37KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=245, version=40116,

count=5, id=199, version=41118,

count=10, id=259, version=23907,

count=13, id=260, version=23907,

count=2, id=261, version=23013,

count=5, id=244, version=40116,

count=6, id=257, version=23907,

count=34, id=261, version=23907,

count=33, id=239, version=40116,

count=5, id=260, productName=VS2015 UPD2 build 23918, version=23918,

count=2, id=257, productName=VS2015 UPD1 build 23506, version=23506,

count=781, id=1, productName=Unmarked objects,

count=123, id=261, productName=VS2015 UPD2 build 23918, version=23918,

count=1, id=256, productName=VS2015 UPD2 build 23918, version=23918,

count=1, id=255, productName=VS2015 UPD2 build 23918, version=23918,

count=10, id=151,

count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,