2026-07-05_a4dcf1671268b7eec7acbc8599c08c04_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_a4dcf1671268b7eec7acbc8599c08c04_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop
Size 3.3MB
Sample260705-l626qabx3x
SHA256 fa2bc3c4132df2f5bbfa5abd983f8ce485360fd8ec65b517a932badce7c6f470
MD5 a4dcf1671268b7eec7acbc8599c08c04
SHA1 5fb3213e9b2fb3e319f7eee54e6ba3b701b9acad
SHA512 82b8fff187d47b93dab4de57475c7c88e0213ecb194ee8eb03ab7f102430b67c574576d02f119b2b3bba9e85f9e567638965162a0fda76e9f30468e2860a9afa
SSDEEP 49152:gv7c62vyyWgBgr2RJFVaBiKse8ihAddVNmxicPmZiwYzE/NzOEn/2Z:ayW8giMiKsohANNALmOYlqEn/2Z
TLSH
T1D8F5AE41BA484C55E2F269F6B012733D16513B2EDEC705A9E2D199687CCFEF782A9303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

vmprotect

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_a4dcf1671268b7eec7acbc8599c08c04_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-05_a4dcf1671268b7eec7acbc8599c08c04_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop

.exe 3.3MB

2026-07-05_a4dcf1671268b7eec7acbc8599c08c04_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop

IMPHASH a9c193dadd52e18499cb01b0e6148d90
SHA256 fa2bc3c4132df2f5bbfa5abd983f8ce485360fd8ec65b517a932badce7c6f470
MD5 a4dcf1671268b7eec7acbc8599c08c04
SHA1 5fb3213e9b2fb3e319f7eee54e6ba3b701b9acad
SHA512 82b8fff187d47b93dab4de57475c7c88e0213ecb194ee8eb03ab7f102430b67c574576d02f119b2b3bba9e85f9e567638965162a0fda76e9f30468e2860a9afa
SSDEEP 49152:gv7c62vyyWgBgr2RJFVaBiKse8ihAddVNmxicPmZiwYzE/NzOEn/2Z:ayW8giMiKsohANNALmOYlqEn/2Z
TLSH
T1D8F5AE41BA484C55E2F269F6B012733D16513B2EDEC705A9E2D199687CCFEF782A9303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2718858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileAttributesW GetFileTime GetStartupInfoW GetSystemTimeAsFileTime HeapFree HeapAlloc HeapReAlloc RtlUnwind Sleep VirtualProtect GetSystemInfo HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate GetFullPathNameW UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount GetTimeZoneInformation GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA GetVolumeInformationW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer GlobalFlags TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedIncrement GetThreadLocale lstrlenA GetModuleHandleA GlobalFindAtomW GetVersionExW CompareStringW GetVersionExA InterlockedDecrement GlobalAddAtomW RaiseException FreeResource GlobalDeleteAtom GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange lstrcmpW FreeLibrary GetModuleHandleW SetLastError GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW LocalFree lstrlenW MulDiv Process32NextW GetProcessTimes OpenProcess Process32FirstW CreateToolhelp32Snapshot WriteFile SetFilePointerEx OpenMutexW WideCharToMultiByte FindClose FindFirstFileW ReadFile GetFileSizeEx VirtualFree LoadLibraryA VirtualAlloc VirtualQuery GetCurrentThreadId CreateFileW DeleteFileW GetModuleFileNameW GetCurrentProcessId SetUnhandledExceptionFilter SetErrorMode CloseHandle GetCurrentProcess CreateThread WritePrivateProfileStringW ExitProcess GetPrivateProfileStringW FileTimeToSystemTime FileTimeToLocalFileTime LoadLibraryW GetProcAddress MultiByteToWideChar FindResourceW LoadResource LockResource SizeofResource GetTickCount QueryPerformanceCounter TerminateProcess GetLastError GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

user32

PostThreadMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SetFocus GetWindowTextW GetForegroundWindow GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow UpdateWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx EqualRect GetDlgCtrlID DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement DestroyMenu GetWindowThreadProcessId GetLastActivePopup MessageBoxW SetCursor SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW IsWindowVisible GetKeyState PeekMessageW ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem RegisterWindowMessageW GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow IsWindow GetWindowLongW GetDlgItem IsWindowEnabled GetNextDlgTabItem EndDialog GetWindow SetWindowContextHelpId GetParent MapDialogRect SetWindowPos PostQuitMessage PostMessageW LoadIconW UnregisterClassW GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu EnableWindow PtInRect ScreenToClient GetCursorPos GetClientRect GetSystemMetrics IsIconic RegisterClipboardFormatW SetTimer SendMessageW UnhookWindowsHookEx CharUpperW MessageBeep GetNextDlgGroupItem InvalidateRgn InvalidateRect CopyAcceleratorTableW SetRect IsRectEmpty CharNextW ReleaseCapture SetCapture LoadCursorW GetSysColorBrush ShowWindow MoveWindow SetWindowTextW IsDialogMessageW EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW SendDlgItemMessageW TabbedTextOutW GetWindowRect DrawTextW

gdi32

DeleteObject GetViewportExtEx GetWindowExtEx PtVisible RectVisible TextOutW ExtTextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC GetStockObject GetBkColor GetTextColor CreateRectRgnIndirect GetRgnBox GetMapMode SetMapMode RestoreDC SaveDC GetObjectW SetBkColor SetTextColor GetClipBox CreateBitmap GetDeviceCaps

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegSetValueExW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW OpenProcessToken RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsW PathFindFileNameW PathStripToRootW PathIsUNCW PathFindExtensionW

oledlg

OleUIBusyW

ole32

CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CLSIDFromString CLSIDFromProgID CoTaskMemAlloc CoTaskMemFree OleUninitialize CoFreeUnusedLibraries OleInitialize CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter

oleaut32

SysStringLen SysFreeString SysAllocStringLen VariantInit VariantClear VariantCopy VariantChangeType SysAllocString DispCallFunc LoadRegTypeLi SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetElemsize SafeArrayCreate SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect

wininet

InternetCloseHandle InternetReadFile HttpQueryInfoA InternetOpenUrlW InternetSetOptionW InternetOpenW

dbghelp

MiniDumpWriteDump

iphlpapi

GetAdaptersAddresses

Name

.text

Size

230KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

73KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

14KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

744KB

Virtual Size

744KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_a4dcf1671268b7eec7acbc8599c08c04_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

oledlg

ole32

oleaut32

wininet

dbghelp

iphlpapi

generic