2026-09-24_15af5620ffe68da083aec3b7fe9a3f35_coinminer_elex_smoke-loader_stop_wapomi

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_15af5620ffe68da083aec3b7fe9a3f35_coinminer_elex_smoke-loader_stop_wapomi
Size 12.7MB
Sample260925-rr9vxaef94
SHA256 05720991e7ff9cbbdbc2181132a38ab133fdeab3793a08bebecf411e5b576580
MD5 15af5620ffe68da083aec3b7fe9a3f35
SHA1 d7f39b5d935b4d27d7f5d3ae09283ca6f66b4b2c
SHA512 4ed68d7675a149ebb3356e0b0dbf50e83789b84344cf080f0d1b670cd5ecf3f91b0f9af6e722741891892b95ee04c86c579df58a961b3b52afe8dd25f19463be
SSDEEP 196608:VxfC8uj5Vpdtx9TBjbS/g4wxDJmIhJ1Q0QdR/1MSInEjjLcK:zGJ3x9VPSpwxDJHJC0eFZj
TLSH
T15AD6D001BBC9C1F2DA8312B5406FB77E46A5964117382BC7D3643E2A6D343E17E3639A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_15af5620ffe68da083aec3b7fe9a3f35_coinminer_elex_smoke-loader_stop_wapomi

File Explorer

2026-09-24_15af5620ffe68da083aec3b7fe9a3f35_coinminer_elex_smoke-loader_stop_wapomi

.exe 12.7MB

2026-09-24_15af5620ffe68da083aec3b7fe9a3f35_coinminer_elex_smoke-loader_stop_wapomi

IMPHASH 462fc74f3dea6aff3d86fda2e1393dd8
SHA256 05720991e7ff9cbbdbc2181132a38ab133fdeab3793a08bebecf411e5b576580
MD5 15af5620ffe68da083aec3b7fe9a3f35
SHA1 d7f39b5d935b4d27d7f5d3ae09283ca6f66b4b2c
SHA512 4ed68d7675a149ebb3356e0b0dbf50e83789b84344cf080f0d1b670cd5ecf3f91b0f9af6e722741891892b95ee04c86c579df58a961b3b52afe8dd25f19463be
SSDEEP 196608:VxfC8uj5Vpdtx9TBjbS/g4wxDJmIhJ1Q0QdR/1MSInEjjLcK:zGJ3x9VPSpwxDJHJC0eFZj
TLSH
T15AD6D001BBC9C1F2DA8312B5406FB77E46A5964117382BC7D3643E2A6D343E17E3639A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21807104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\MiniFighterSeason3\MiniFighter_Korea\Client\MiniFighterClient\Release\client.pdb

dbghelp

SymFromAddr StackWalk SymFunctionTableAccess SymGetModuleBase SymGetLineFromAddr64 SymInitialize SymSetOptions EnumerateLoadedModules GetTimestampForLoadedLibrary MiniDumpWriteDump SymCleanup

dinput8

DirectInput8Create

openal32

alSourceQueueBuffers alSourceUnqueueBuffers alGenBuffers alSourcei alcDestroyContext alGetSourcei alSourceRewind alSourcePlay alGetEnumValue alBufferData alDeleteSources alGenSources alGetError alSourceStop alDeleteBuffers alcMakeContextCurrent alcCloseDevice alcCreateContext alcOpenDevice

kernel32

CreateFileMappingA CompareStringA GetProcAddress LoadLibraryA FreeLibrary GetLocaleInfoA GetLocaleInfoW IsDBCSLeadByte GetCurrentThread GetCurrentProcess WinExec GetModuleFileNameA GetCurrentThreadId GetCurrentProcessId GetSystemDirectoryA IsDBCSLeadByteEx InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection Sleep CreateThread CreateEventA SetEvent Process32Next Process32First CreateToolhelp32Snapshot OpenProcess GetSystemTimeAsFileTime HeapAlloc GetProcessHeap HeapFree GlobalFree GlobalUnlock GlobalLock GlobalAlloc TerminateProcess SetEndOfFile ResumeThread ResetEvent SetThreadPriority GetExitCodeProcess WaitForMultipleObjects CreateProcessA SetFilePointer OpenEventA OpenMutexA MoveFileExA lstrcatA TerminateThread ReleaseMutex GetComputerNameA QueryPerformanceCounter IsBadReadPtr GetModuleFileNameW VirtualProtect OpenFileMappingA GetCurrentDirectoryA VirtualQuery VirtualAlloc VirtualFree LoadLibraryExA GetTempFileNameA GetTempPathA GetFileInformationByHandle DuplicateHandle SetStdHandle CreatePipe GetStdHandle PeekNamedPipe IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetDateFormatA GetFullPathNameA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA FlushFileBuffers SetCurrentDirectoryA GetStringTypeW GetStringTypeA GetTimeZoneInformation GetFileType SetHandleCount GetConsoleMode GetConsoleCP SetConsoleCtrlHandler IsValidCodePage GetOEMCP GetACP FatalAppExitA ExitThread GetCPInfo LCMapStringW LCMapStringA MoveFileA GetStartupInfoA GetCommandLineA GetDriveTypeA GetVersionExA IsDebuggerPresent UnhandledExceptionFilter RtlUnwind QueueUserWorkItem MapViewOfFile GetTempPathW GetTempFileNameW CreateProcessW ReleaseSemaphore CreateSemaphoreW SetThreadPriorityBoost CreateEventW SetErrorMode CancelIo HeapCreate HeapValidate PostQueuedCompletionStatus SetLastError QueryPerformanceFrequency CreateDirectoryW GetCurrentDirectoryW GetComputerNameW Process32FirstW Process32NextW SetCurrentDirectoryW GlobalMemoryStatus GetDiskFreeSpaceW GetSystemTime DebugBreak TryEnterCriticalSection InitializeCriticalSectionAndSpinCount OutputDebugStringW lstrcmpA lstrcpyA CopyFileA WaitForSingleObject RemoveDirectoryA SetFileAttributesA GetFileAttributesA FileTimeToLocalFileTime FileTimeToSystemTime CreateFileA GetFileSize LocalAlloc ReadFile LocalFree GetTickCount SetUnhandledExceptionFilter lstrcpynA FindFirstFileA FindNextFileA FindClose CreateMutexA GetLastError CloseHandle ExitProcess lstrlenA WideCharToMultiByte FindResourceExA FindResourceA LoadResource LockResource SizeofResource GetLocalTime GetModuleHandleA MultiByteToWideChar DeleteFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringW SetEnvironmentVariableA GetFileAttributesW GetFileAttributesExW GetFileAttributesExA GetDiskFreeSpaceExW GetFullPathNameW RemoveDirectoryW DeleteFileW CreateHardLinkW GetDiskFreeSpaceExA CreateHardLinkA MoveFileW CopyFileW GetShortPathNameW FindFirstFileW FindNextFileW _lopen _lread _lclose CreateFileW FindResourceExW FindResourceW RaiseException HeapSize HeapReAlloc HeapDestroy CreateWaitableTimerA FormatMessageA OutputDebugStringA lstrlenW SetWaitableTimer SystemTimeToFileTime TlsSetValue GetSystemInfo TlsGetValue TlsFree TlsAlloc InterlockedExchange InterlockedCompareExchange InterlockedIncrement InterlockedDecrement CreateMutexW UnmapViewOfFile WriteFile GetFileTime DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime CreateDirectoryA GetModuleHandleW lstrcmpiA GetTimeFormatA

user32

wsprintfA keybd_event ShowCursor wsprintfW SendMessageA MessageBoxW ReleaseCapture SetCapture MessageBoxA GetSystemMetrics GetCursorPos DefWindowProcA PostQuitMessage GetKeyboardLayout ClientToScreen GetAsyncKeyState FindWindowA SetRect IsWindowVisible GetParent GetClipboardData RegisterClipboardFormatA OpenClipboard SetClipboardData CloseClipboard InflateRect OffsetRect PtInRect SystemParametersInfoA CharNextA PostMessageA SendMessageW CharNextW SetKeyboardState GetWindowRgn GetCursor GetIconInfo DrawIcon ClipCursor SetWindowLongA LoadIconA LoadCursorA RegisterClassA CreateWindowExA UpdateWindow SetFocus SetWindowPos ChangeDisplaySettingsA EnumDisplaySettingsA LoadImageA CreateDialogParamA DestroyWindow GetClientRect GetDC ReleaseDC wvsprintfA ShowWindow PeekMessageA GetMessageA TranslateMessage GetFocus DispatchMessageA GetWindowRect MoveWindow IsDialogMessageA

gdi32

GetTextExtentExPointA AddFontResourceExA CreateFontA RemoveFontResourceExA GetTextAlign SetTextAlign CreatePen MoveToEx LineTo SetTextColor SetBkColor TextOutW SetBkMode TextOutA GetTextExtentPoint32W CreateRectRgn OffsetRgn SelectClipRgn BitBlt CreateDIBSection GetStockObject CreateDCA GetDeviceCaps DeleteObject GetPixel SetPixel CreateCompatibleDC SelectObject GetObjectA StretchBlt DeleteDC GetTextExtentPoint32A ExtTextOutA

advapi32

CryptVerifySignatureA RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegSetValueExA CryptGetHashParam CryptDeriveKey CryptAcquireContextW CryptGenRandom RegSetValueExW RegCreateKeyExW SetSecurityDescriptorDacl InitializeSecurityDescriptor CryptDecrypt CryptCreateHash CryptHashData RegCloseKey CryptDestroyHash RegEnumValueA GetUserNameA CryptAcquireContextA CryptImportKey CryptEncrypt CryptDestroyKey CryptReleaseContext RegCreateKeyA RegDeleteValueA

shell32

SHGetSpecialFolderPathA ShellExecuteA

ole32

CoInitializeEx CoUninitialize CoInitialize CoCreateInstance

oleaut32

SysFreeString VariantClear GetErrorInfo SysStringByteLen SysAllocString VariantChangeType VariantInit SetErrorInfo CreateErrorInfo SysAllocStringByteLen

ijl15

ord5 ord4 ord6 ord2 ord3

shlwapi

PathCombineW PathIsRelativeW PathFileExistsA

winmm

PlaySoundA mciGetErrorStringA timeSetEvent timeKillEvent timeGetTime mciSendCommandA

ws2_32

WSASetLastError bind WSASendTo WSAEventSelect listen WSARecvFrom WSARecv accept WSAGetOverlappedResult WSASocketW __WSAFDIsSet WSACleanup htons inet_addr gethostbyname gethostname closesocket shutdown WSAAsyncSelect send getsockopt select ioctlsocket WSAIoctl getpeername getsockname recvfrom inet_ntoa ntohs WSAStartup setsockopt WSAGetLastError connect socket recv sendto WSASend

ddraw

DirectDrawCreateEx

dsound

ord11 ord1

imm32

ImmGetCandidateListA ImmGetConversionStatus ImmNotifyIME ImmAssociateContext ImmSetCompositionStringA ImmGetDefaultIMEWnd ImmGetCompositionStringW ImmGetCompositionStringA ImmGetProperty ImmIsIME ImmSetConversionStatus ImmGetOpenStatus ImmGetContext ImmReleaseContext ImmGetIMEFileNameA ImmGetCandidateListW

wininet

HttpQueryInfoA InternetCloseHandle InternetOpenUrlA InternetOpenA InternetReadFile InternetQueryDataAvailable

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

psapi

GetModuleFileNameExA EnumProcessModules GetProcessMemoryInfo EnumProcesses

mswsock

GetAcceptExSockaddrs

rpcrt4

RpcStringFreeA RpcStringFreeW UuidToStringA UuidFromStringA UuidCreate UuidToStringW

Name

.text

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

150KB

Virtual Size

8.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

=�� u�

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=11, id=28, productName=VS2002 (.NET) build 9466, version=9466,

count=1, id=110, productName=VS2005 build 50727, version=50727,

count=1, id=150, version=20413,

count=49, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=9, id=132, productName=VS2008 build 21022, version=21022,

count=395, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=109, productName=VS2005 build 50727, version=50727,

count=34, id=123, productName=VS2005 build 50727, version=50727,

count=9, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=6, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=15, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=22, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=3, id=123, version=21213,

count=483, id=1, productName=Unmarked objects,

count=2, id=11, version=8966,

count=760, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,