2025-12-21_6044330e2df57070dd8ff662df31a039_amadey_coinminer_elex_hellokitty_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2025-12-21_6044330e2df57070dd8ff662df31a039_amadey_coinminer_elex_hellokitty_remcos_smoke-loader
Size 145KB
Sample251221-edf98aypcs
SHA256 b3a0db2cecd8398a2e999b0d397714d27907d605eea945293a0f4d652a76da26
MD5 6044330e2df57070dd8ff662df31a039
SHA1 bc060720535172cd1d75bb99faf45bbb717a2ccc
SHA512 bd318b01eb969628249348d896f0273616bb625228313fd15989f385f73c9d652dc2d68f648b68a9c131d85d70b06fedde93d88f39513f51f925de1b09aa169f
SSDEEP 3072:zpGuQ83Nu6ShqeBPWW9Sg9cY5Y4NqQvH34tKAd/hZ:0utuBIgZq24ld/hZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-12-21_6044330e2df57070dd8ff662df31a039_amadey_coinminer_elex_hellokitty_remcos_smoke-loader

File Explorer

2025-12-21_6044330e2df57070dd8ff662df31a039_amadey_coinminer_elex_hellokitty_remcos_smoke-loader

.exe 145KB

2025-12-21_6044330e2df57070dd8ff662df31a039_amadey_coinminer_elex_hellokitty_remcos_smoke-loader

IMPHASH 363ff47bfbd36f44979b32a9b9aba0d9
SHA256 b3a0db2cecd8398a2e999b0d397714d27907d605eea945293a0f4d652a76da26
MD5 6044330e2df57070dd8ff662df31a039
SHA1 bc060720535172cd1d75bb99faf45bbb717a2ccc
SHA512 bd318b01eb969628249348d896f0273616bb625228313fd15989f385f73c9d652dc2d68f648b68a9c131d85d70b06fedde93d88f39513f51f925de1b09aa169f
SSDEEP 3072:zpGuQ83Nu6ShqeBPWW9Sg9cY5Y4NqQvH34tKAd/hZ:0utuBIgZq24ld/hZ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36338

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

psapi

EnumProcesses GetProcessImageFileNameW

netapi32

NetShareEnum NetApiBufferFree

iphlpapi

GetIpNetTable

shlwapi

PathFindExtensionW PathFindFileNameW PathAddBackslashW

kernel32

GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW FindFirstFileW FindNextFileW GetCurrentProcess WriteFile lstrcpynW InterlockedDecrement GetCommandLineW CreateFileW SetFileAttributesW Sleep lstrcatW CloseHandle CreateThread lstrcpyW lstrcmpW MoveFileExW ReadFile GetFileSizeEx FindFirstVolumeW EnterCriticalSection FindClose GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection WaitForSingleObject OpenProcess GetLastError SetEvent GetDiskFreeSpaceExW ResetEvent GetWindowsDirectoryW SetFilePointerEx ExitProcess CreateProcessW GetVolumePathNamesForVolumeNameW CreateEventA FindNextVolumeW lstrcmpiW GetTickCount DeleteCriticalSection QueryPerformanceCounter GetConsoleCP GetConsoleMode HeapReAlloc GetEnvironmentStringsW FreeEnvironmentStringsW DecodePointer SetStdHandle GetProcessHeap FlushFileBuffers WriteConsoleW HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RaiseException GetStdHandle MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW GetACP HeapFree HeapAlloc GetFileType LCMapStringW GetStringTypeW

user32

CharLowerW wsprintfW GetKeyboardLayoutList

advapi32

ChangeServiceConfigW CryptAcquireContextA CryptGenRandom CryptReleaseContext AdjustTokenPrivileges CloseServiceHandle OpenSCManagerW LookupPrivilegeValueA ControlService OpenServiceW QueryServiceStatusEx

Sharing

General

Malware Config

Signatures

File Explorer

2025-12-21_6044330e2df57070dd8ff662df31a039_amadey_coinminer_elex_hellokitty_remcos_smoke-loader

psapi

netapi32

iphlpapi

shlwapi

kernel32

user32

advapi32

generic