2026-07-02_06d0fb94cf84d59a34fbfb13b1f84b8b_amadey_coinminer_elex_glassworm_remcos_smoke-loader_stealc_tofsee

General

Target
2026-07-02_06d0fb94cf84d59a34fbfb13b1f84b8b_amadey_coinminer_elex_glassworm_remcos_smoke-loader_stealc_tofsee
Size 4.8MB
Sample260702-pad1ssf12j
SHA256 4936482dcbf1b4d52e6c56811be28b95e766012ced85145e62905b2831e85d5f
MD5 06d0fb94cf84d59a34fbfb13b1f84b8b
SHA1 6528801d9df9ae4281fdef5762607778550e133f
SHA512 c1a0e81220f6b8709a20afcd8a359cffd45554eb00b47817e8af1b7647e845acbdb8e4a4fe85ddb9081b740ccb1bc73abaf293d0516800d2cefa58983d476b6d
SSDEEP 98304:W9vP01k7lRnuFznQ65cOgbBAUZLp/k/9:YvP5wMVFs
TLSH
T101364B01FD914E62C8B2013489A70B510A38DE535F40B697336C759D6F7EBEA2A763EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_06d0fb94cf84d59a34fbfb13b1f84b8b_amadey_coinminer_elex_glassworm_remcos_smoke-loader_stealc_tofsee

2026-07-02_06d0fb94cf84d59a34fbfb13b1f84b8b_amadey_coinminer_elex_glassworm_remcos_smoke-loader_stealc_tofsee

.exe 4.8MB

SHA256 4936482dcbf1b4d52e6c56811be28b95e766012ced85145e62905b2831e85d5f
MD5 06d0fb94cf84d59a34fbfb13b1f84b8b
SHA1 6528801d9df9ae4281fdef5762607778550e133f
SHA512 c1a0e81220f6b8709a20afcd8a359cffd45554eb00b47817e8af1b7647e845acbdb8e4a4fe85ddb9081b740ccb1bc73abaf293d0516800d2cefa58983d476b6d
SSDEEP 98304:W9vP01k7lRnuFznQ65cOgbBAUZLp/k/9:YvP5wMVFs
TLSH
T101364B01FD914E62C8B2013489A70B510A38DE535F40B697336C759D6F7EBEA2A763EC
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Windows executables referencing non-Windows User-Agents
Detects executables containing URLs to raw contents of a Github gist
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

4

Entry point

449038

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths