qelvminer-1[.]1[.]0-windows-x86_64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
qelvminer-1.1.0-windows-x86_64.exe
Size 9.4MB
Sample260929-w2f3ssselb
SHA256 9845c245686ccf24c72044fd6d1f6d0be7a4ee528efc0194b39741c51f330bce
MD5 0b9dbdb9290c53fd7f7f070f5bec478b
SHA1 faf49c397f2b88ad54175226644887f3f5160f89
SHA512 c210ba7e97d939636570c7b285250596f0b98484a39c0501dbe906e8a3e04386879d4f4a17f3699258ebc96129c94db6189e2ed35ce728cabd740d48ca2f4df7
SSDEEP 98304:FFmu5MejTbCMQoYwi9H1V6ckqr7Hd8VBfVyTN6TmYTEefS2H+:FFVKNVV5r2lyTYTnTdfSc
TLSH
T186A64A46F66281EDC169C074931AB332FA727C8E073477E76BD44A322E65FD06A38B45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
qelvminer-1.1.0-windows-x86_64.exe

File Explorer

qelvminer-1.1.0-windows-x86_64.exe

.exe 9.4MB

qelvminer-1.1.0-windows-x86_64.exe

IMPHASH 700d1c14f015d1fec06cdc110e29fa29
SHA256 9845c245686ccf24c72044fd6d1f6d0be7a4ee528efc0194b39741c51f330bce
MD5 0b9dbdb9290c53fd7f7f070f5bec478b
SHA1 faf49c397f2b88ad54175226644887f3f5160f89
SHA512 c210ba7e97d939636570c7b285250596f0b98484a39c0501dbe906e8a3e04386879d4f4a17f3699258ebc96129c94db6189e2ed35ce728cabd740d48ca2f4df7
SSDEEP 98304:FFmu5MejTbCMQoYwi9H1V6ckqr7Hd8VBfVyTN6TmYTEefS2H+:FFVKNVV5r2lyTYTnTdfSc
TLSH
T186A64A46F66281EDC169C074931AB332FA727C8E073477E76BD44A322E65FD06A38B45
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6899872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

qelvminer.pdb

kernel32

RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW lstrlenW WideCharToMultiByte MultiByteToWideChar GetEnvironmentVariableW FormatMessageW GetCommandLineW QueryPerformanceFrequency GetFileInformationByHandleEx RtlCaptureContext HeapAlloc GetFullPathNameW WriteConsoleW GetConsoleOutputCP RemoveVectoredExceptionHandler ReleaseMutex CreateFileW AddVectoredExceptionHandler SetEnvironmentVariableW QueryPerformanceCounter CreateMutexA GetCurrentProcessId GetCurrentProcess LoadLibraryA WaitForSingleObjectEx GetModuleHandleW CreateEventA GetFileInformationByHandle GetFinalPathNameByHandleW SetLastError SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx SetWaitableTimer CreateWaitableTimerExW GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode SetHandleInformation GetConsoleMode GetCurrentThread SetThreadStackGuarantee WaitForSingleObject GetFileType CreateThread GetSystemInfo GetStdHandle ExitProcess LoadLibraryExA HeapReAlloc PostQueuedCompletionStatus SwitchToThread SetConsoleCtrlHandler GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime HeapFree GetProcessHeap GetModuleHandleA Sleep CloseHandle GetModuleFileNameW GetProcAddress FreeLibrary LoadLibraryExW SetThreadErrorMode GetLastError SetFileInformationByHandle GetCurrentThreadId InitializeSListHead GetTimeZoneInformationForYear SetUnhandledExceptionFilter

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ws2_32

WSACleanup WSAStartup WSASocketW freeaddrinfo WSARecvFrom sendto recv shutdown send WSASend listen bind getsockopt connect ioctlsocket socket getsockname WSAIoctl accept closesocket WSAGetLastError setsockopt getaddrinfo

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

ntdll

NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtWriteFile NtReadFile

oleaut32

SysFreeString SysStringLen GetErrorInfo

opengl32

wglGetProcAddress wglCreateContext wglMakeCurrent wglDeleteContext wglGetCurrentContext

user32

DestroyWindow CreateWindowExA RegisterClassExA DefWindowProcA GetDC ReleaseDC GetClientRect

gdi32

SetPixelFormat GetPixelFormat ChoosePixelFormat SwapBuffers DescribePixelFormat

vcruntime140

memset __current_exception_context __current_exception memcpy memcmp __CxxFrameHandler3 memmove __C_specific_handler

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

log logf log2 truncf exp2f log2f atan2 atan2f powf fma asin fmaf exp2 __setusermatherr fmod cbrt expf fmodf trunc pow floorf floor round ceilf ceil log1pf cosf asinf acosf cosh log1p _hypotf _hypot atanf atan acos cos tanhf tanh tanf tan sinhf sinh sinf sin exp coshf

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit _seh_filter_exe _set_app_type _register_thread_local_exe_atexit_callback terminate _c_exit _cexit __p___argv _configure_narrow_argv _initialize_onexit_table __p___argc _initialize_narrow_environment _get_initial_narrow_environment _exit exit _initterm_e _initterm

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode