2026-07-09_707b85fc51292323f592f96581e606c4_amadey_coinminer_elex_glassworm_kwampirs_mafia_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_707b85fc51292323f592f96581e606c4_amadey_coinminer_elex_glassworm_kwampirs_mafia_remcos_smoke-loader
Size 618KB
Sample260709-ecfmasds5z
SHA256 5b402aab0dddaaa64635903e69d3ca894b87dfa073971321fa0324d98111495f
MD5 707b85fc51292323f592f96581e606c4
SHA1 290c1218645ca7ba35ca1a9df9269d6383628388
SHA512 262974a1f22f9096ef40cdb5f3c0f13a04731974a5018334d8322785a0f89b3bf8689694c4d18ef7200ad81ef6af4135b24d79d436857b68fd7b507637cb4679
SSDEEP 12288:55FAQjU/Lik8CQ3uEuZ9oawhtyybAsLAk4uwXH3XEL0r2xN1R:qcUQPxuZ98Es8k3OH3C0rQb
TLSH
T1EAD46B30D602D13AE5A604B287BD4BBF942C6A2A475974C3F3D81D762FA51D2BA3170F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_707b85fc51292323f592f96581e606c4_amadey_coinminer_elex_glassworm_kwampirs_mafia_remcos_smoke-loader

File Explorer

2026-07-09_707b85fc51292323f592f96581e606c4_amadey_coinminer_elex_glassworm_kwampirs_mafia_remcos_smoke-loader

.exe 618KB

2026-07-09_707b85fc51292323f592f96581e606c4_amadey_coinminer_elex_glassworm_kwampirs_mafia_remcos_smoke-loader

IMPHASH fe8cd0edefdc88a5f20fe38f2239521b
SHA256 5b402aab0dddaaa64635903e69d3ca894b87dfa073971321fa0324d98111495f
MD5 707b85fc51292323f592f96581e606c4
SHA1 290c1218645ca7ba35ca1a9df9269d6383628388
SHA512 262974a1f22f9096ef40cdb5f3c0f13a04731974a5018334d8322785a0f89b3bf8689694c4d18ef7200ad81ef6af4135b24d79d436857b68fd7b507637cb4679
SSDEEP 12288:55FAQjU/Lik8CQ3uEuZ9oawhtyybAsLAk4uwXH3XEL0r2xN1R:qcUQPxuZ98Es8k3OH3C0rQb
TLSH
T1EAD46B30D602D13AE5A604B287BD4BBF942C6A2A475974C3F3D81D762FA51D2BA3170F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

189777

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\stcode\wloader\资源同步助手2.0\XLoader\Release\XLoader.pdb

kernel32

CreateDirectoryA GetFileAttributesA DeleteFileA LockResource LoadResource SizeofResource FindResourceW VirtualQuery Process32NextW lstrcmpiW Process32FirstW CreateToolhelp32Snapshot FileTimeToSystemTime FileTimeToLocalFileTime GetProcessTimes OpenProcess InitializeCriticalSection DeleteCriticalSection Sleep EnterCriticalSection LeaveCriticalSection CreateThread GetComputerNameA GlobalFree GlobalAlloc GetNativeSystemInfo GetProcAddress GetModuleHandleW UpdateProcThreadAttribute InitializeProcThreadAttributeList CreateProcessW TerminateProcess GetTickCount WriteFile DeleteFileW GetLogicalDriveStringsA SetFilePointer CreateFileW GetLastError ReadFile GetLocalTime CreateMutexA LoadLibraryW GetTempPathW GetTempPathA GetCurrentProcess CloseHandle GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte WriteConsoleW GetProcessHeap SetStdHandle GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo HeapSize FlushFileBuffers GetConsoleMode GetConsoleCP InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree SetEndOfFile OutputDebugStringA TlsSetValue TlsGetValue TlsAlloc GetStartupInfoW GetFileType InitializeCriticalSectionAndSpinCount HeapFree HeapAlloc RtlUnwind RaiseException EncodePointer DecodePointer HeapReAlloc GetSystemTimeAsFileTime GetCommandLineA HeapSetInformation IsProcessorFeaturePresent HeapCreate ExitProcess GetStdHandle GetModuleFileNameW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SetHandleCount

user32

LoadStringA

advapi32

RegQueryValueExA LookupPrivilegeValueW CreateProcessAsUserW AdjustTokenPrivileges RegCloseKey RegOpenKeyExA RegEnumKeyExA OpenProcessToken

shell32

SHGetSpecialFolderPathA SHGetFolderPathA ShellExecuteA

shlwapi

PathRemoveFileSpecA PathFileExistsA

winhttp

WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpConnect WinHttpSetTimeouts WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSetOption WinHttpAddRequestHeaders WinHttpReadData WinHttpQueryDataAvailable WinHttpOpen

rpcrt4

UuidCreateSequential

iphlpapi

GetAdaptersInfo SendARP

ws2_32

inet_ntoa gethostbyname WSAStartup inet_addr WSACleanup

GetModuleHandle64 GetProcAddress64 GetThreadContext64 ReadProcessMemory64 SetLastErrorFromX64Call SetThreadContext64 VirtualAllocEx64 VirtualFreeEx64 VirtualProtectEx64 VirtualQueryEx64 WriteProcessMemory64 X64Call _cJSON_AddArrayToObject@8 _cJSON_AddBoolToObject@12 _cJSON_AddFalseToObject@8 _cJSON_AddItemReferenceToArray@8 _cJSON_AddItemReferenceToObject@12 _cJSON_AddItemToArray@8 _cJSON_AddItemToObject@12 _cJSON_AddItemToObjectCS@12 _cJSON_AddNullToObject@8 _cJSON_AddNumberToObject@16 _cJSON_AddObjectToObject@8 _cJSON_AddRawToObject@12 _cJSON_AddStringToObject@12 _cJSON_AddTrueToObject@8 _cJSON_Compare@12 _cJSON_CreateArray@0 _cJSON_CreateArrayReference@4 _cJSON_CreateBool@4 _cJSON_CreateDoubleArray@8 _cJSON_CreateFalse@0 _cJSON_CreateFloatArray@8 _cJSON_CreateIntArray@8 _cJSON_CreateNull@0 _cJSON_CreateNumber@8 _cJSON_CreateObject@0 _cJSON_CreateObjectReference@4 _cJSON_CreateRaw@4 _cJSON_CreateString@4 _cJSON_CreateStringArray@8 _cJSON_CreateStringReference@4 _cJSON_CreateTrue@0 _cJSON_Delete@4 _cJSON_DeleteItemFromArray@8 _cJSON_DeleteItemFromObject@8 _cJSON_DeleteItemFromObjectCaseSensitive@8 _cJSON_DetachItemFromArray@8 _cJSON_DetachItemFromObject@8 _cJSON_DetachItemFromObjectCaseSensitive@8 _cJSON_DetachItemViaPointer@8 _cJSON_Duplicate@8 _cJSON_GetArrayItem@8 _cJSON_GetArraySize@4 _cJSON_GetErrorPtr@0 _cJSON_GetObjectItem@8 _cJSON_GetObjectItemCaseSensitive@8 _cJSON_GetStringValue@4 _cJSON_HasObjectItem@8 _cJSON_InitHooks@4 _cJSON_InsertItemInArray@12 _cJSON_IsArray@4 _cJSON_IsBool@4 _cJSON_IsFalse@4 _cJSON_IsInvalid@4 _cJSON_IsNull@4 _cJSON_IsNumber@4 _cJSON_IsObject@4 _cJSON_IsRaw@4 _cJSON_IsString@4 _cJSON_IsTrue@4 _cJSON_Minify@4 _cJSON_Parse@4 _cJSON_ParseWithOpts@12 _cJSON_Print@4 _cJSON_PrintBuffered@12 _cJSON_PrintPreallocated@16 _cJSON_PrintUnformatted@4 _cJSON_ReplaceItemInArray@12 _cJSON_ReplaceItemInObject@12 _cJSON_ReplaceItemInObjectCaseSensitive@12 _cJSON_ReplaceItemViaPointer@12 _cJSON_SetNumberHelper@12 _cJSON_Version@0 _cJSON_free@4 _cJSON_malloc@4

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_707b85fc51292323f592f96581e606c4_amadey_coinminer_elex_glassworm_kwampirs_mafia_remcos_smoke-loader

kernel32

user32

advapi32

shell32

shlwapi

winhttp

rpcrt4

iphlpapi

ws2_32

generic