2026-11-07_440a3ae823fcae6a60c0735a31cb00b1_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop

General

Target
2026-11-07_440a3ae823fcae6a60c0735a31cb00b1_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop
Size 34.0MB
Sample261109-k8jlqaec53
SHA256 70b57d7586c6bc9e42d3df550458a0c3c40a5d7b63e7ad63d15b8adf70f2b322
MD5 440a3ae823fcae6a60c0735a31cb00b1
SHA1 790db7f5a76b703cd14d816b707f435fb9d11839
SHA512 7b427b3a56a01c1a32497508de70778839c3d15e7d17699887254faeac811a5e30c76d8ccdf52b18350726bd61f6546244cb649473369095c3854f196fc57bb6
SSDEEP 786432:vByRfTtLeu9wu0q9Z5BAiL9leZnCF8mqzt4y:vByRfTtLeFqz5BZL+gFxuL
TLSH
T189773302BB868672F44A163948A71B798BF76C65AF3393CB63507B1D2C333D16B34256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-07_440a3ae823fcae6a60c0735a31cb00b1_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop

File Explorer

2026-11-07_440a3ae823fcae6a60c0735a31cb00b1_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop

.exe 34.0MB

2026-11-07_440a3ae823fcae6a60c0735a31cb00b1_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop

IMPHASH ccbd660d75e8df65cc93919427910a09
SHA256 70b57d7586c6bc9e42d3df550458a0c3c40a5d7b63e7ad63d15b8adf70f2b322
MD5 440a3ae823fcae6a60c0735a31cb00b1
SHA1 790db7f5a76b703cd14d816b707f435fb9d11839
SHA512 7b427b3a56a01c1a32497508de70778839c3d15e7d17699887254faeac811a5e30c76d8ccdf52b18350726bd61f6546244cb649473369095c3854f196fc57bb6
SSDEEP 786432:vByRfTtLeu9wu0q9Z5BAiL9leZnCF8mqzt4y:vByRfTtLeFqz5BZL+gFxuL
TLSH
T189773302BB868672F44A163948A71B798BF76C65AF3393CB63507B1D2C333D16B34256
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

96:55:87:6a:61:00:ec:57:84:a6:69:f8:89:52:21:8a:e5:2a:45:4e

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Global Graphics Software Limited,OU=Digital ID Class 3 - Microsoft VBA Software Validation v2,O=Global Graphics Software Limited,L=Cambridge,ST=Cambridgeshire,C=GB

Chains

Jun 27, 2012

CN=Global Graphics Software Limited,OU=Digital ID Class 3 - Microsoft VBA Software Validation v2,O=Global Graphics Software Limited,L=Cambridge,ST=Cambridgeshire,C=GB

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Global Graphics Software Limited,OU=Digital ID Class 3 - Microsoft VBA Software Validation v2,O=Global Graphics Software Limited,L=Cambridge,ST=Cambridgeshire,C=GB

Serial Number

26:e9:f4:9e:b7:e4:7e:0b:3c:a6:ea:dc:66:e5:47:b9

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 9, 2010 - Jun 9, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Minor OS version

0

Major OS version

4

Entry point

16863

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Users\acardy\workspaces\main\unity\depot\global\gdoc\CorelFusion\dev\DocCreator\win\MSPHost\release\MSPHost.pdb

kernel32

CreateDirectoryW GetModuleFileNameW GetLastError WaitForSingleObject FindResourceW SizeofResource LoadResource CreateProcessW CloseHandle LockResource GetExitCodeProcess GetTempPathW CompareStringW CompareStringA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RemoveDirectoryW DeleteFileW GetSystemTimeAsFileTime HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoW RaiseException RtlUnwind GetModuleHandleA GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement EnterCriticalSection LeaveCriticalSection Sleep WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode GetTimeZoneInformation ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA MultiByteToWideChar GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetCPInfo GetACP GetOEMCP IsValidCodePage VirtualAlloc HeapReAlloc SetStdHandle FlushFileBuffers SetFilePointer WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileW InitializeCriticalSection HeapSize LoadLibraryA GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW CreateFileA SetEndOfFile ReadFile SetEnvironmentVariableA

ole32

StringFromGUID2 CoCreateGuid

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_440a3ae823fcae6a60c0735a31cb00b1_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop

PE Signature issue

kernel32

ole32

generic