2026-04-15_280d722a30c9f455e014bcf0929f7c56_cloudeye_coinminer_elex_maze_rhadamanthys_smoke-loader

General

Target
2026-04-15_280d722a30c9f455e014bcf0929f7c56_cloudeye_coinminer_elex_maze_rhadamanthys_smoke-loader
Size 474KB
Sample260415-rvs2kab151
SHA256 743cb78c44d0313ac5a3bcc1be09acd35942a773f2d0a438a9e936ca3df032b3
MD5 280d722a30c9f455e014bcf0929f7c56
SHA1 93a03b49b3713323102a0f37a9a488b2bd84b17e
SHA512 88e6d42539c0b4e4d4852dd5546da41b85f21f897ba5514ac8211d039e606e04762b4aac06b202a2de6b2a53576526806f6a07bdd7287d3e4cdf1a07294c3ac5
SSDEEP 6144:5gWpUhPQFfTjgVR/SHdCzx5xoX3/Di6R/SHdCzxtoEbR7OjwYdhjmGCrxI:uWpUhPQFrUo+03/DipGHRwCG
TLSH
T1F1A4D182B7D08C7AE456057005BA8B31E63EFD704FB04BCBAB95155B5EB42C31D2A26F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-15_280d722a30c9f455e014bcf0929f7c56_cloudeye_coinminer_elex_maze_rhadamanthys_smoke-loader

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

File Explorer

2026-04-15_280d722a30c9f455e014bcf0929f7c56_cloudeye_coinminer_elex_maze_rhadamanthys_smoke-loader

.exe 474KB

2026-04-15_280d722a30c9f455e014bcf0929f7c56_cloudeye_coinminer_elex_maze_rhadamanthys_smoke-loader

IMPHASH 75e7fb7458b2e2dd8c3b4d1f0020fc10
SHA256 743cb78c44d0313ac5a3bcc1be09acd35942a773f2d0a438a9e936ca3df032b3
MD5 280d722a30c9f455e014bcf0929f7c56
SHA1 93a03b49b3713323102a0f37a9a488b2bd84b17e
SHA512 88e6d42539c0b4e4d4852dd5546da41b85f21f897ba5514ac8211d039e606e04762b4aac06b202a2de6b2a53576526806f6a07bdd7287d3e4cdf1a07294c3ac5
SSDEEP 6144:5gWpUhPQFfTjgVR/SHdCzx5xoX3/Di6R/SHdCzxtoEbR7OjwYdhjmGCrxI:uWpUhPQFrUo+03/DipGHRwCG
TLSH
T1F1A4D182B7D08C7AE456057005BA8B31E63EFD704FB04BCBAB95155B5EB42C31D2A26F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

9451

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\browser\app\firefox.pdb

kernel32

GetEnvironmentVariableW GetProcessIoCounters FreeLibrary SetDllDirectoryW VerSetConditionMask GetCurrentProcess SetEnvironmentVariableW GetModuleHandleW WideCharToMultiByte LoadLibraryW GetFileAttributesW VerifyVersionInfoA GetModuleFileNameW MultiByteToWideChar FlushInstructionCache GetProcAddress VirtualProtectEx VirtualAllocEx GetModuleHandleA LoadLibraryExA ExpandEnvironmentStringsW LoadLibraryExW SetFilePointerEx ReadFile CreateFileW CloseHandle IsDebuggerPresent RaiseException GetLastError GetCommandLineW EncodePointer DecodePointer IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection SetLastError GetCurrentThreadId ExitProcess GetModuleHandleExW GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetACP GetOEMCP GetCPInfo HeapSize RtlUnwind HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree HeapAlloc SetStdHandle OutputDebugStringW GetStringTypeW CompareStringW LCMapStringW GetConsoleCP GetConsoleMode HeapReAlloc SetEnvironmentVariableA ReadConsoleW FlushFileBuffers WriteConsoleW SetEndOfFile

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-15_280d722a30c9f455e014bcf0929f7c56_cloudeye_coinminer_elex_maze_rhadamanthys_smoke-loader

kernel32

generic