2026-07-05_5329746761ddd245407d9c2d648b3342_amadey_coinminer_elex_maze_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_5329746761ddd245407d9c2d648b3342_amadey_coinminer_elex_maze_smoke-loader_stealc
Size 1.1MB
Sample260705-tmlcvsdx7y
SHA256 8a4c57fc2f0f51bb84029cf13fa019d3bc863509ba79181d3983f2e87632fc6f
MD5 5329746761ddd245407d9c2d648b3342
SHA1 9a84d5e6491b0aed1b62cea41548aa3aadb7c642
SHA512 4ae7015ac504fe1bd9908e8262c56aee2335336e49e8c2dbd27da96e167d00c00b35d1426db52a33c3990eb47dc853ec0f0f6708f2ef7b71cd1e3dc4709fe015
SSDEEP 24576:kLfDNE8r6TSCcAI621KWgZWBKCV8FXhO5HWDCx+ITZHtX5ezjrBn:cE8+TSdz1KXZZFXU52DCoITZNX5ezjrR
TLSH
T12B453814FBC3E2A9CE6301B01666FB1A517C6D059B295ED7D7D83F0A1530AC2BA3B50E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-05_5329746761ddd245407d9c2d648b3342_amadey_coinminer_elex_maze_smoke-loader_stealc

.exe 1.1MB

2026-07-05_5329746761ddd245407d9c2d648b3342_amadey_coinminer_elex_maze_smoke-loader_stealc

IMPHASH bc962d253bdd8cd0033547ae9e6cbe87
SHA256 8a4c57fc2f0f51bb84029cf13fa019d3bc863509ba79181d3983f2e87632fc6f
MD5 5329746761ddd245407d9c2d648b3342
SHA1 9a84d5e6491b0aed1b62cea41548aa3aadb7c642
SHA512 4ae7015ac504fe1bd9908e8262c56aee2335336e49e8c2dbd27da96e167d00c00b35d1426db52a33c3990eb47dc853ec0f0f6708f2ef7b71cd1e3dc4709fe015
SSDEEP 24576:kLfDNE8r6TSCcAI621KWgZWBKCV8FXhO5HWDCx+ITZHtX5ezjrBn:cE8+TSdz1KXZZFXU52DCoITZNX5ezjrR
TLSH
T12B453814FBC3E2A9CE6301B01666FB1A517C6D059B295ED7D7D83F0A1530AC2BA3B50E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

9c:0d:96:c3:2c:7b:25:75:5d:70:90:04:f6:95:54:62:39:cd:28:69:b3:13:00:9c:ed:48:83:0e:0d:1d:97:22

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,C=CN

Chains

Dec 25, 2019

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

6a:ed:88:03:ab:60:6f:56:26:66:ea:12:80:33:4d:af:6f:1e:2b:b4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,C=CN

Chains

Dec 25, 2019

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,C=CN

Serial Number

0d:70:a1:7d:75:6f:ec:88:85:9a:29:46:be:d7:69:44

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 7, 2019 - May 8, 2020

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,C=CN

Serial Number

01:40:74:8d:43:58:a1:47:81:d6:a9:c3:07:b3:aa:9c

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2019 - May 8, 2020

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

725947

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Codes\CommonPlatform\RCMiniPage\bin\Win32\Release\pdb\2345MiniPage.pdb

kernel32

LoadLibraryW GetModuleFileNameW CreateFileW GetTempPathW GetProcAddress GetLocalTime GetCurrentThreadId CloseHandle GetCurrentProcessId LoadLibraryExW GetModuleHandleW GetFileAttributesW GetCommandLineW FreeLibrary SetUnhandledExceptionFilter MoveFileExW InitializeCriticalSectionAndSpinCount RaiseException GetLastError MoveFileW DecodePointer lstrcatW DeleteCriticalSection DeleteFileW LocalFree CreateProcessW lstrcmpiW FindFirstFileW FileTimeToSystemTime FindClose CreateMutexW WaitForSingleObject Sleep ReleaseMutex MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW GetEnvironmentVariableW ExpandEnvironmentStringsW GetLongPathNameW GetFileAttributesExW GetExitCodeProcess WaitForMultipleObjects HeapAlloc HeapFree GetProcessHeap OpenProcess GetVersionExW QueryDosDeviceW GetFileSize SetFilePointer SetEndOfFile GetCurrentProcess WriteFile ReadFile GetFileTime FindResourceW LoadResource LockResource GetSystemInfo GetFullPathNameW GetTempFileNameW CreateDirectoryW lstrlenW GetCurrentDirectoryW GetWindowsDirectoryW SetFileAttributesW FindNextFileW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetFileSizeEx WideCharToMultiByte GetACP MultiByteToWideChar SetEnvironmentVariableA GetLogicalDriveStringsW SetEvent FormatMessageW GlobalMemoryStatusEx ResumeThread ResetEvent CreateEventW InterlockedExchangeAdd InterlockedExchange SetLastError DeviceIoControl FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP OutputDebugStringW HeapReAlloc GetTimeZoneInformation GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount SetStdHandle WriteConsoleW ReadConsoleW SetFileTime QueryPerformanceCounter GetFileType GetStdHandle HeapSize GetModuleHandleExW ExitProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW EncodePointer GetStringTypeW GetSystemTimeAsFileTime IsDebuggerPresent IsProcessorFeaturePresent CreateThread ExitThread RtlUnwind GetCPInfo UnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW

user32

PostMessageW IsWindow MessageBoxW wsprintfW SendMessageTimeoutW

shell32

CommandLineToArgvW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFolderPathW

ole32

CoTaskMemFree

shlwapi

PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_5329746761ddd245407d9c2d648b3342_amadey_coinminer_elex_maze_smoke-loader_stealc

PE Signature issue

kernel32

user32

shell32

ole32

shlwapi

generic