2026-11-09_72e9a1651629e7aa18d99386c3d36c59_coinminer_elex_emotet_remcos_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_72e9a1651629e7aa18d99386c3d36c59_coinminer_elex_emotet_remcos_wannacry
Size 1.5MB
Sample261110-tk4fnabx21
SHA256 3553004c3e265ecd2059afdd349f8f68bb2848bae13294a25bd7999ce06e3f34
MD5 72e9a1651629e7aa18d99386c3d36c59
SHA1 2031d5a72cd421f11959722e17cf8e10a0f07b36
SHA512 09f7441d9347f33c98711082f4a5139cf2a8aa7b49cca978a9090cb27d1bf4607c630b1097304f8af635086bb967d8336cbe6c6d973fc94fe4b08cb61645195f
SSDEEP 49152:o/as11nrH/PBcFPFs/m6A4CBiqAofUuozw:o//b+FdZ
TLSH
T14B755BA1BA72C437F1B188304229B75667787A329720844FEFC65B2DD8A49C14D37FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-11-09_72e9a1651629e7aa18d99386c3d36c59_coinminer_elex_emotet_remcos_wannacry

File Explorer

2026-11-09_72e9a1651629e7aa18d99386c3d36c59_coinminer_elex_emotet_remcos_wannacry

.exe 1.5MB

2026-11-09_72e9a1651629e7aa18d99386c3d36c59_coinminer_elex_emotet_remcos_wannacry

IMPHASH 11ae4c70d7bd7a1fdc45734f9cda8239
SHA256 3553004c3e265ecd2059afdd349f8f68bb2848bae13294a25bd7999ce06e3f34
MD5 72e9a1651629e7aa18d99386c3d36c59
SHA1 2031d5a72cd421f11959722e17cf8e10a0f07b36
SHA512 09f7441d9347f33c98711082f4a5139cf2a8aa7b49cca978a9090cb27d1bf4607c630b1097304f8af635086bb967d8336cbe6c6d973fc94fe4b08cb61645195f
SSDEEP 49152:o/as11nrH/PBcFPFs/m6A4CBiqAofUuozw:o//b+FdZ
TLSH
T14B755BA1BA72C437F1B188304229B75667787A329720844FEFC65B2DD8A49C14D37FA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

22:0f:90:57:ab:c3:10:32:e4:ba:f5:dd:68:17:6f:73:86:b4:11:78

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=BUFFALO INC.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Production Dept.,O=BUFFALO INC.,L=30-20\,Ohsu 3-chome\,Naka-ku\,Nagoya,ST=Aichi,C=JP

Chains

Mar 9, 2012

CN=BUFFALO INC.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Production Dept.,O=BUFFALO INC.,L=30-20\,Ohsu 3-chome\,Naka-ku\,Nagoya,ST=Aichi,C=JP

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=BUFFALO INC.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Production Dept.,O=BUFFALO INC.,L=30-20\,Ohsu 3-chome\,Naka-ku\,Nagoya,ST=Aichi,C=JP

Serial Number

58:33:34:00:47:84:59:3c:68:15:64:c2:ce:6a:36:b5

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2011 - Jun 14, 2012

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

593104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TlsSetValue GlobalReAlloc TlsFree GlobalHandle TlsAlloc LocalAlloc DeleteCriticalSection InitializeCriticalSection lstrcpynA MulDiv GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GetPrivateProfileStringA FindResourceA LoadResource LockResource CreateEventA SuspendThread SetThreadPriority ResumeThread SetEvent GlobalDeleteAtom lstrcmpiA GetCurrentThread SetLastError LocalFree lstrlenA InterlockedDecrement SetFilePointer FileTimeToLocalFileTime DosDateTimeToFileTime LocalFileTimeToFileTime lstrcatA FindFirstFileA FindNextFileA FindClose lstrcmpA GetProcessHeap HeapAlloc HeapFree CreateToolhelp32Snapshot Process32First OpenProcess TerminateProcess Process32Next GetWindowsDirectoryA GetSystemDirectoryA GetFileSize GlobalLock GlobalUnlock GetSystemDefaultLangID GlobalAlloc GlobalFree ReadFile GetLogicalDrives EnterCriticalSection LeaveCriticalSection LocalReAlloc GetDriveTypeA GetDiskFreeSpaceA FindResourceExA GetCPInfo GetOEMCP SetErrorMode FlushFileBuffers SetEndOfFile MoveFileA GetFullPathNameA RtlUnwind GetTimeZoneInformation GetSystemTime GetLocalTime ExitProcess GetStartupInfoA GetCommandLineA RaiseException GetSystemTimeAsFileTime HeapReAlloc CreateThread ExitThread GetACP HeapSize LCMapStringA LCMapStringW GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW IsBadReadPtr IsBadCodePtr SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA InterlockedExchange TlsGetValue GlobalFlags GetCurrentDirectoryA OutputDebugStringA GetProcessVersion BeginUpdateResourceA MultiByteToWideChar UpdateResourceA EndUpdateResourceA GetCurrentThreadId GetUserDefaultLCID GetLocaleInfoA CompareFileTime lstrcpyA GetModuleHandleA GetFileAttributesA WideCharToMultiByte GetPrivateProfileIntA WritePrivateProfileStringA CreateProcessA CreateDirectoryA SetFileTime GetVolumeInformationA GetFileTime CopyFileA GetModuleFileNameA WriteFile LoadLibraryA GetProcAddress FreeLibrary GetCurrentProcess GetVersion CreateMutexA GetLastError CreateFileA DeviceIoControl GetVersionExA SetFileAttributesA GetComputerNameA SystemTimeToFileTime FileTimeToSystemTime WaitForSingleObject CloseHandle Sleep DeleteFileA InterlockedIncrement RemoveDirectoryA

hid

HidD_FlushQueue HidD_GetAttributes HidD_GetHidGuid HidD_GetSerialNumberString

setupapi

SetupDiGetDeviceInterfaceDetailA CM_Locate_DevNodeA CM_Get_Parent CM_Get_Device_IDA CM_Get_DevNode_Registry_PropertyA CM_Get_Child CM_Get_Sibling SetupDiGetClassDevsA SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList

winmm

timeKillEvent timeSetEvent

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

user32

PostMessageA wsprintfA MessageBoxA GetSystemMetrics DispatchMessageA TranslateMessage PeekMessageA FindWindowExA SendMessageA EnumWindows GetWindowTextA IsDialogMessageA SetWindowTextA MoveWindow wvsprintfA ClientToScreen GetDC DestroyMenu GetClassNameA PtInRect LoadCursorA GetSysColorBrush ReleaseDC BeginPaint EndPaint TabbedTextOutA DrawTextA UnregisterClassA GrayStringA FindWindowA DrawIcon GetAsyncKeyState InsertMenuA RemoveMenu GetSystemMenu IsIconic GetWindowRect GetClientRect UpdateWindow IsWindowVisible SetTimer SendDlgItemMessageA MapWindowPoints GetSysColor AdjustWindowRectEx ScreenToClient CopyRect GetTopWindow WinHelpA GetClassInfoA RegisterClassA GetMenu GetMenuItemCount GetMenuItemID TrackPopupMenu GetWindowTextLengthA GetDlgCtrlID CreateWindowExA GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA DefWindowProcA GetMessageTime GetMessagePos GetWindow SetWindowLongA RegisterWindowMessageA GetWindowPlacement EndDialog IsWindow CreateDialogIndirectParamA DestroyWindow MapDialogRect SetWindowPos ShowWindow GetCapture SetActiveWindow SetFocus GetDlgItem GetMenuCheckMarkDimensions LoadBitmapA GetMenuState SetMenuItemBitmaps CheckMenuItem EnableMenuItem GetFocus GetNextDlgTabItem GetMessageA GetActiveWindow CallNextHookEx ValidateRect SetWindowsHookExA SetCursor PostQuitMessage LoadStringA GetLastActivePopup IsWindowEnabled GetWindowLongA GetForegroundWindow GetWindowThreadProcessId AttachThreadInput SystemParametersInfoA GetParent SetForegroundWindow LoadMenuA ModifyMenuA GetSubMenu GetCursorPos LoadIconA EnableWindow GetKeyState KillTimer

gdi32

DeleteObject GetDeviceCaps ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode GetStockObject SelectObject RestoreDC SaveDC DeleteDC GetObjectA SetBkColor SetTextColor GetClipBox CreateBitmap PtVisible TextOutA ExtTextOutA Escape EnumFontFamiliesExA RectVisible

comdlg32

GetSaveFileNameA GetOpenFileNameA

winspool.drv

OpenPrinterA ClosePrinter DocumentPropertiesA

advapi32

RegCloseKey RegFlushKey RegSetValueExA RegCreateKeyExA RegDeleteValueA RegOpenKeyExA GetUserNameA CryptAcquireContextA CryptReleaseContext CryptGenRandom RegDeleteKeyA RegQueryValueExA

shell32

SHGetSpecialFolderLocation SHGetSpecialFolderPathA ShellExecuteA SHFileOperationA ShellExecuteExA SHGetPathFromIDListA Shell_NotifyIconA SHChangeNotify

comctl32

PropertySheetA CreatePropertySheetPageA ord17 DestroyPropertySheetPage

imagehlp

MakeSureDirectoryPathExists

wininet

HttpOpenRequestA HttpSendRequestA InternetQueryOptionA InternetCloseHandle HttpQueryInfoA InternetReadFile InternetConnectA InternetOpenA InternetSetOptionA

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_72e9a1651629e7aa18d99386c3d36c59_coinminer_elex_emotet_remcos_wannacry

PE Signature issue

kernel32

hid

setupapi

winmm

version

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

imagehlp

wininet

generic