2026-10-13_0f3eda19eeef386ceb2b6c8fb37d6141_coinminer_elex_icedid_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-13_0f3eda19eeef386ceb2b6c8fb37d6141_coinminer_elex_icedid_stop
Size 2.3MB
Sample261015-yd535aws2n
SHA256 4f80d22c22dd70c01b62810d98f600a5a8af7f17e964726e11e8f128a1216cf6
MD5 0f3eda19eeef386ceb2b6c8fb37d6141
SHA1 c727ece8907e6150b8ff7eb09a327d65a033ecfb
SHA512 6dbdc59516ac5092516dda332c6af0320bc78ce655bbd97bbef9f15c2af8f0f3bfa5aaf57964e5ec3fdbf4e9c2c3a69814a832a0f1b62212e3737737f6c3421a
SSDEEP 49152:yPIAVUjfDTNR9njjbkJ0P5ZTN9VInKcE8aSo:Y/VUjflXAJ0PtGKB
TLSH
T17EB5AFA1E785C377D1428570E0E65BB496D4FC53A3E889A321D03E7CFD7A282362D25B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-13_0f3eda19eeef386ceb2b6c8fb37d6141_coinminer_elex_icedid_stop

File Explorer

2026-10-13_0f3eda19eeef386ceb2b6c8fb37d6141_coinminer_elex_icedid_stop

.exe 2.3MB

2026-10-13_0f3eda19eeef386ceb2b6c8fb37d6141_coinminer_elex_icedid_stop

IMPHASH 00a82a72f7ba204c410885741a663852
SHA256 4f80d22c22dd70c01b62810d98f600a5a8af7f17e964726e11e8f128a1216cf6
MD5 0f3eda19eeef386ceb2b6c8fb37d6141
SHA1 c727ece8907e6150b8ff7eb09a327d65a033ecfb
SHA512 6dbdc59516ac5092516dda332c6af0320bc78ce655bbd97bbef9f15c2af8f0f3bfa5aaf57964e5ec3fdbf4e9c2c3a69814a832a0f1b62212e3737737f6c3421a
SSDEEP 49152:yPIAVUjfDTNR9njjbkJ0P5ZTN9VInKcE8aSo:Y/VUjflXAJ0PtGKB
TLSH
T17EB5AFA1E785C377D1428570E0E65BB496D4FC53A3E889A321D03E7CFD7A282362D25B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

82:a0:63:a1:d1:a1:a5:60:a2:be:f9:e9:41:92:2f:9c:77:84:66:6f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=CPUID,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=CPUID,L=DUNKERQUE,ST=NORD,C=FR

Chains

Oct 14, 2013

CN=CPUID,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=CPUID,L=DUNKERQUE,ST=NORD,C=FR

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=CPUID,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=CPUID,L=DUNKERQUE,ST=NORD,C=FR

Serial Number

53:c8:b5:47:13:88:2d:4d:54:39:51:18:04:93:5e

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 6, 2012 - Feb 6, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

800176

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\CPUID\applications\cpu_z\cpu_z_en_vc2008\Release\cpuz_x32.pdb

winmm

timeGetTime

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

kernel32

SetErrorMode GetStartupInfoW HeapAlloc RaiseException RtlUnwind HeapReAlloc ExitProcess HeapSize SetUnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType HeapCreate HeapDestroy VirtualFree GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetConsoleCP GetConsoleMode VirtualAlloc InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage SetStdHandle GetConsoleOutputCP GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW SetEndOfFile FlushFileBuffers WritePrivateProfileStringW lstrlenA GlobalFlags InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle EnterCriticalSection TlsGetValue LeaveCriticalSection GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW LoadLibraryExW InterlockedExchange GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW lstrcmpW GetSystemDirectoryA lstrcmpiA GetCurrentThreadId FreeResource GlobalLock GlobalUnlock FormatMessageW MulDiv QueryPerformanceCounter QueryPerformanceFrequency GetTickCount LocalAlloc LocalFree SetThreadAffinityMask GetSystemInfo GetProcessAffinityMask SetProcessAffinityMask ReadFile CreateEventA GetOverlappedResult WriteConsoleA SetFilePointer GetModuleHandleA FindResourceA GetWindowsDirectoryA RemoveDirectoryA GetComputerNameA CreateFileA DeviceIoControl GetCurrentDirectoryA GetModuleFileNameA CreateDirectoryA CreateMutexA SetLastError GetLocalTime ReleaseMutex DeleteFileA GetVersionExA LoadLibraryA SetCurrentDirectoryA GetTempPathA GetCurrentProcessId GetProcessHeap HeapFree GlobalMemoryStatus GetTempPathW GetVersionExW WinExec lstrlenW lstrcatW lstrcpyW WriteFile GetCurrentProcess CreateFileW WriteConsoleW ExitThread Sleep ResumeThread SetThreadPriority GetStdHandle CreateThread WideCharToMultiByte LoadLibraryW FreeLibrary MultiByteToWideChar GetLastError GetModuleFileNameW GetProcAddress GetModuleHandleW WaitForSingleObject CloseHandle InterlockedDecrement GlobalSize GlobalReAlloc GlobalAlloc GlobalFree SetCurrentDirectoryW GetComputerNameW GetCurrentDirectoryW LockResource SizeofResource LoadResource FindResourceW GetStartupInfoA

user32

LoadCursorW GetSysColorBrush UnregisterClassW DestroyMenu PostQuitMessage LoadIconW SendDlgItemMessageA WinHelpW GetClassLongW GetClassNameW GetForegroundWindow GetTopWindow GetMessageTime GetMessagePos MapWindowPoints TrackPopupMenu SetMenu SetForegroundWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW GetMenu SystemParametersInfoA GetWindowPlacement SetMenuItemBitmaps SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW IsWindowVisible GetKeyState PeekMessageW GetCursorPos ValidateRect GetDlgCtrlID SetWindowTextW IsDialogMessageW SetDlgItemTextW SetDlgItemInt SendDlgItemMessageW GetDesktopWindow DestroyWindow IsWindow GetNextDlgTabItem EndDialog GetWindowTextLengthW GetWindowTextW GetWindow GetWindowThreadProcessId GetLastActivePopup EndPaint BeginPaint ScreenToClient GrayStringW DrawTextExW DrawTextW TabbedTextOutW SetPropW GetCapture GetActiveWindow SetActiveWindow SetWindowPos ShowWindow GetPropW RemovePropW GetFocus SetFocus GetWindowLongW GetParent GetDlgItem GetMenuCheckMarkDimensions IsWindowEnabled GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu UnhookWindowsHookEx wsprintfA ModifyMenuW WindowFromPoint PostMessageW ReleaseCapture DrawEdge DrawFocusRect FrameRect DrawFrameControl InflateRect FillRect CopyRect CheckMenuItem EnableMenuItem AppendMenuW PtInRect ClientToScreen CreatePopupMenu CreateCursor SetWindowLongW SetCursor DestroyCursor UpdateWindow InvalidateRect KillTimer DestroyIcon OffsetRect GetSysColor DrawIcon GetSystemMetrics IsIconic SetTimer LoadImageW MessageBoxW wsprintfW ReleaseDC CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetClientRect GetDC GetWindowDC EnableWindow GetWindowRect LoadBitmapW SendMessageW RegisterWindowMessageW CreateDialogIndirectParamW

gdi32

CreatePen DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutW TextOutW RectVisible PtVisible CreateCompatibleDC MoveToEx LineTo GetClipBox SetMapMode SetTextColor SetBkMode SetBkColor RestoreDC SaveDC GetTextExtentPoint32W SelectObject CreateSolidBrush SetPixel GetCurrentObject CreateFontIndirectW GetPixel CreateBitmap CreateFontW GetDIBits RealizePalette SelectPalette GetObjectW GetStockObject CreatePalette GetSystemPaletteEntries GetDeviceCaps BitBlt CreateCompatibleBitmap DeleteObject

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegQueryValueExA ImpersonateSelf OpenThreadToken OpenProcessToken AllocateAndInitializeSid InitializeSecurityDescriptor RegOpenKeyExA RevertToSelf FreeSid AccessCheck IsValidSecurityDescriptor SetSecurityDescriptorOwner SetSecurityDescriptorGroup RegSetValueExW RegCreateKeyExW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegQueryValueExW OpenSCManagerA ControlService StartServiceA OpenServiceA DeleteService CreateServiceA CloseServiceHandle RegCloseKey RegQueryValueW RegOpenKeyExW SetSecurityDescriptorDacl AddAccessAllowedAce InitializeAcl GetLengthSid

shell32

SHGetFolderPathA ShellExecuteW

shlwapi

PathFindExtensionW PathFindFileNameW PathRemoveFileSpecW

ole32

CoInitializeEx CoInitializeSecurity CoUninitialize CoInitialize CoCreateInstance StringFromGUID2 CoTaskMemFree CoSetProxyBlanket

oleaut32

SysAllocString SysAllocStringByteLen SysStringByteLen SysFreeString VariantChangeType VariantClear VariantInit SysStringLen SafeArrayGetElemsize SafeArrayGetElement SafeArrayGetVartype

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_0f3eda19eeef386ceb2b6c8fb37d6141_coinminer_elex_icedid_stop

PE Signature issue

winmm

version

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

generic