2026-07-20_e6ec3f89f7c5ea67b95d99153098e355_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader

General

Target
2026-07-20_e6ec3f89f7c5ea67b95d99153098e355_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader
Size 462KB
Sample260720-rdrgeaev31
SHA256 7d13f4cffee799477d241c65e153a386e837d023a39bd457f922281401491cde
MD5 e6ec3f89f7c5ea67b95d99153098e355
SHA1 4004661a913568c1f18e3e801a3cee2a468f1f17
SHA512 a0857d8154d0f1f830d73d58179f6ce927174e562dbaf651613ea958165b5ff6a3f07ce3a89472c7898c19003a3602c61bbb4b90115f70f7d0d49ba1a7e6deff
SSDEEP 12288:SJ0uOaK4SzTGTTfz5RxHbIGTIUpD80QICq8:K0uOYS3ETfzlbIGTIUjDC3
TLSH
T14FA4BF107292C232D576053196F99EBA896E7D140F3059DB93C83F2ABDB02D25A32F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_e6ec3f89f7c5ea67b95d99153098e355_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-07-20_e6ec3f89f7c5ea67b95d99153098e355_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader

.exe 462KB

2026-07-20_e6ec3f89f7c5ea67b95d99153098e355_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 6a57edacc1e3ab1f452509f55a4b1ed1
SHA256 7d13f4cffee799477d241c65e153a386e837d023a39bd457f922281401491cde
MD5 e6ec3f89f7c5ea67b95d99153098e355
SHA1 4004661a913568c1f18e3e801a3cee2a468f1f17
SHA512 a0857d8154d0f1f830d73d58179f6ce927174e562dbaf651613ea958165b5ff6a3f07ce3a89472c7898c19003a3602c61bbb4b90115f70f7d0d49ba1a7e6deff
SSDEEP 12288:SJ0uOaK4SzTGTTfz5RxHbIGTIUpD80QICq8:K0uOYS3ETfzlbIGTIUjDC3
TLSH
T14FA4BF107292C232D576053196F99EBA896E7D140F3059DB93C83F2ABDB02D25A32F77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

99344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\zhanlue\2345capture\bin\Win32\Release\pdb\2345Capture.pdb

kernel32

GetLastError InitializeCriticalSectionAndSpinCount WaitForSingleObject CloseHandle ExpandEnvironmentStringsW GetPrivateProfileStringW CreateFileW GetVersionExW FreeLibrary GetCurrentThreadId LoadLibraryW GetCurrentProcess WritePrivateProfileStringW FormatMessageW SetFileAttributesW GetFileAttributesW GetModuleHandleW LoadLibraryExW GetProcAddress GetFullPathNameW CreateDirectoryW GetFileSize GetFileSizeEx DeleteFileW SetEndOfFile SetFilePointer ReadFile lstrcpyW lstrcatW lstrlenW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle WriteFile GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP GetStringTypeW HeapFree HeapAlloc GetFileType LCMapStringW DecodePointer OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap HeapSize HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW LoadLibraryA InitializeCriticalSection GetFileAttributesExW GetEnvironmentVariableW OpenProcess LocalFree lstrcmpiW CreateMutexW ReleaseMutex

shell32

SHGetPathFromIDListW SHGetSpecialFolderLocation

ole32

CoTaskMemFree

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_e6ec3f89f7c5ea67b95d99153098e355_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader

kernel32

shell32

ole32

generic