2026-07-24_f6205d9a8511a096bd8c44b475deb1c2_amadey_coinminer_elex_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-24_f6205d9a8511a096bd8c44b475deb1c2_amadey_coinminer_elex_smoke-loader
Size 822KB
Sample260724-wahsbatvcw
SHA256 0c6c50dc7120a70d91e1b09cff661fac3a1fdeb114c401d4c75d7a2469837444
MD5 f6205d9a8511a096bd8c44b475deb1c2
SHA1 474c1e5bc9733b876980419a5773993b0754f8f9
SHA512 fb6861362c08287bdaa898243abb8051142d475d954305f91de0af88346d56bc21300d0c31a36e6ff0778673d31bdfcf9cce8cee68e8ab7e252001d899867d31
SSDEEP 24576:2L1qrjtL4KVcPne87HtO/DF1+9codjeWyZxeCEk:25q/WKSR2TPod5
TLSH
T13405022177E0C432E1A316324DF9D6A575B6BC309D39920BB3C93B2EEDB06D1DA25352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-24_f6205d9a8511a096bd8c44b475deb1c2_amadey_coinminer_elex_smoke-loader

File Explorer

2026-07-24_f6205d9a8511a096bd8c44b475deb1c2_amadey_coinminer_elex_smoke-loader

.exe 822KB

2026-07-24_f6205d9a8511a096bd8c44b475deb1c2_amadey_coinminer_elex_smoke-loader

IMPHASH bf11383207c2a7adba9cfc1928118a9c
SHA256 0c6c50dc7120a70d91e1b09cff661fac3a1fdeb114c401d4c75d7a2469837444
MD5 f6205d9a8511a096bd8c44b475deb1c2
SHA1 474c1e5bc9733b876980419a5773993b0754f8f9
SHA512 fb6861362c08287bdaa898243abb8051142d475d954305f91de0af88346d56bc21300d0c31a36e6ff0778673d31bdfcf9cce8cee68e8ab7e252001d899867d31
SSDEEP 24576:2L1qrjtL4KVcPne87HtO/DF1+9codjeWyZxeCEk:25q/WKSR2TPod5
TLSH
T13405022177E0C432E1A316324DF9D6A575B6BC309D39920BB3C93B2EEDB06D1DA25352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

100262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Build\onlinetech\GameConsoleService\Build\Release\GamesAppService.pdb

kernel32

FileTimeToLocalFileTime SystemTimeToFileTime GetSystemTime LocalFileTimeToFileTime FindClose GetFileAttributesW GetCurrentDirectoryW GetFileAttributesExW CreateDirectoryW SetFileAttributesW ReleaseMutex CreateMutexA FlushFileBuffers ReadFile SetEndOfFile CompareStringW WriteConsoleW GetTimeZoneInformation SetStdHandle GetStringTypeW GetConsoleMode GetConsoleCP PeekNamedPipe LoadLibraryW LCMapStringW SetFilePointer GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter VirtualQuery VirtualProtect DebugBreak GetFullPathNameW DeleteFileW CreateFileW WriteFile InitializeCriticalSection FormatMessageA GetCurrentProcessId lstrlenA WideCharToMultiByte Sleep GetCommandLineW SetErrorMode Process32NextW ProcessIdToSessionId Process32FirstW CreateToolhelp32Snapshot WTSGetActiveConsoleSessionId CreateProcessW ResumeThread GetSystemDirectoryW TerminateProcess GetLastError SetLastError GetCurrentThreadId InterlockedIncrement InterlockedDecrement GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar RaiseException lstrcmpiW GetModuleHandleW GetProcAddress lstrlenW FreeLibrary OutputDebugStringW GetCurrentProcess DuplicateHandle OpenProcess CreateThread SetEvent LeaveCriticalSection EnterCriticalSection CreateEventW GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GetACP GetCPInfo HeapCreate GetStdHandle ExitProcess IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter FindFirstFileExW GetDriveTypeW FileTimeToSystemTime RtlUnwind GetStartupInfoW HeapSetInformation GetCommandLineA GetSystemInfo VirtualAlloc EncodePointer DecodePointer GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetExitCodeProcess WaitForSingleObject CloseHandle GetFileInformationByHandle SetEnvironmentVariableA

user32

GetThreadDesktop GetProcessWindowStation CharNextW OpenWindowStationW SetProcessWindowStation EnumDesktopsW CloseWindowStation OpenDesktopW MessageBoxW SetThreadDesktop EnumDesktopWindows GetWindowThreadProcessId CharUpperW wsprintfW PostThreadMessageW LoadStringW GetMessageW TranslateMessage EnumWindowStationsW DispatchMessageW

advapi32

OpenSCManagerW RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegOpenKeyExW RegSetValueExW DeleteService ControlService RegisterServiceCtrlHandlerW SetServiceStatus StartServiceCtrlDispatcherW RegQueryValueExW DeregisterEventSource ReportEventW RegisterEventSourceW CloseServiceHandle ChangeServiceConfig2W OpenServiceW CreateServiceW CreateProcessAsUserW OpenProcessToken DuplicateTokenEx SetTokenInformation GetTokenInformation GetSecurityDescriptorControl GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner LookupAccountSidW IsValidSid GetLengthSid CopySid GetSidSubAuthority InitializeSid GetSidLengthRequired AdjustTokenPrivileges LookupPrivilegeValueW RegDeleteValueW RegCreateKeyExW RegDeleteKeyW

shell32

SHGetSpecialFolderPathW

ole32

CoTaskMemAlloc CoInitializeSecurity CoReleaseServerProcess CoAddRefServerProcess CoTaskMemRealloc CoRevokeClassObject StringFromGUID2 CoCreateInstance CoUninitialize CoTaskMemFree CoResumeClassObjects CoInitializeEx CoRegisterClassObject

oleaut32

VarUI4FromStr SysStringLen SysFreeString LoadRegTypeLi LoadTypeLi SysAllocStringLen SysAllocString VariantClear VariantInit RegisterTypeLi UnRegisterTypeLi

shlwapi

PathFileExistsW PathQuoteSpacesW PathUnquoteSpacesW

wtsapi32

WTSQueryUserToken

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock LoadUserProfileW UnloadUserProfile

crypt32

CertFreeCertificateContext CertNameToStrA CryptMsgGetAndVerifySigner CryptMsgClose CryptQueryObject

wintrust

WinVerifyTrust

psapi

GetModuleFileNameExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-24_f6205d9a8511a096bd8c44b475deb1c2_amadey_coinminer_elex_smoke-loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wtsapi32

userenv

crypt32

wintrust

psapi

generic