2026-07-31_91450fa866170cb7ffd52ccf79dd1d73_amadey_coinminer_elex_manuscrypt_rhadamanthys_smoke-loader_stop_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_91450fa866170cb7ffd52ccf79dd1d73_amadey_coinminer_elex_manuscrypt_rhadamanthys_smoke-loader_stop_virut
Size 330KB
Sample260731-datkpsbe95
SHA256 359024ee23d6fdee81b81117d09da926bcdae56a169365ef6831aa267f3007ca
MD5 91450fa866170cb7ffd52ccf79dd1d73
SHA1 f366140bfdbff253946297f089e08cc0b92c02b2
SHA512 d1817e27e96d3576390e5bd3bbf2ae0441707957f9fae9cf0f0c3b2ac72b7a5131b237182aabaa824c42be410147b0f55538d70be0297db850b0d36f6c4f32ee
SSDEEP 6144:38PVG3bMv/2azol+PlUMtXmyzQYI1phlXfKvZtqgrIGSAVx:IG3U
TLSH
T149743A82748DC973C1BB42B150D64FB5CA23E8308AAA993BF350DE9D397F690117D267
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-31_91450fa866170cb7ffd52ccf79dd1d73_amadey_coinminer_elex_manuscrypt_rhadamanthys_smoke-loader_stop_virut

File Explorer

2026-07-31_91450fa866170cb7ffd52ccf79dd1d73_amadey_coinminer_elex_manuscrypt_rhadamanthys_smoke-loader_stop_virut

.exe 330KB

2026-07-31_91450fa866170cb7ffd52ccf79dd1d73_amadey_coinminer_elex_manuscrypt_rhadamanthys_smoke-loader_stop_virut

IMPHASH e5aa7ffaeb31ae9c34f722c9b0a4833a
SHA256 359024ee23d6fdee81b81117d09da926bcdae56a169365ef6831aa267f3007ca
MD5 91450fa866170cb7ffd52ccf79dd1d73
SHA1 f366140bfdbff253946297f089e08cc0b92c02b2
SHA512 d1817e27e96d3576390e5bd3bbf2ae0441707957f9fae9cf0f0c3b2ac72b7a5131b237182aabaa824c42be410147b0f55538d70be0297db850b0d36f6c4f32ee
SSDEEP 6144:38PVG3bMv/2azol+PlUMtXmyzQYI1phlXfKvZtqgrIGSAVx:IG3U
TLSH
T149743A82748DC973C1BB42B150D64FB5CA23E8308AAA993BF350DE9D397F690117D267
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

88:a0:fb:e3:ec:d1:77:32:f1:a1:64:78:1c:26:5e:c8:a8:f2:ef:4d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=2345.com,OU=桌面软件事业部,O=2345.com,L=shanghai,ST=shanghai,C=CN

Chains

Sep 10, 2015

CN=2345.com,OU=桌面软件事业部,O=2345.com,L=shanghai,ST=shanghai,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=2345.com,OU=桌面软件事业部,O=2345.com,L=shanghai,ST=shanghai,C=CN

Serial Number

55:84:61:31:5b:4a:38:8f:b3:bc:78:26:9c:49:97:2d

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 4, 2014 - Sep 2, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

349276

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

InternetSetOptionW InternetCloseHandle InternetReadFile InternetOpenUrlW InternetOpenW HttpQueryInfoW

kernel32

DeleteFileW GetTempFileNameW FindResourceW LoadLibraryW LoadResource GetModuleFileNameW GetLongPathNameW CreateFileW GetTickCount LockResource Sleep SizeofResource GetTempPathW WriteFile WaitForSingleObject GetExitCodeProcess GetLastError lstrlenW LoadLibraryExW InterlockedDecrement FreeLibrary InterlockedIncrement DeleteCriticalSection InitializeCriticalSection MultiByteToWideChar lstrcmpiW GetStringTypeA GetConsoleMode GetConsoleCP SetFilePointer GetCurrentProcessId QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW WideCharToMultiByte GetFileAttributesW IsValidCodePage GetOEMCP GetCPInfo GetModuleFileNameA GetStdHandle ExitProcess TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleA HeapSize HeapCreate HeapDestroy RtlUnwind GetStartupInfoW CreateThread ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime HeapReAlloc GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange GetStringTypeW VirtualAlloc VirtualFree IsProcessorFeaturePresent CloseHandle SetLastError GetCurrentProcess FlushInstructionCache LoadLibraryA GetVersionExW GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection GetCurrentThreadId RaiseException GetConsoleOutputCP WriteConsoleW CreateFileA FlushFileBuffers HeapAlloc GetProcessHeap HeapFree WriteConsoleA SetStdHandle InterlockedCompareExchange GetVersionExA LCMapStringA

user32

UnregisterClassA MessageBoxW GetParent BringWindowToTop GetWindow EnableWindow SystemParametersInfoW GetWindowRect SetWindowPos SetWindowTextW SetDlgItemTextW GetDlgItem PostQuitMessage GetClientRect ShowWindow GetMessageW PeekMessageW CreateDialogParamW DispatchMessageW TranslateMessage DestroyWindow CharNextW LoadMenuW SetWindowLongW RegisterClassExW SetForegroundWindow GetCursorPos LoadImageW PostMessageW GetSubMenu RegisterWindowMessageW LoadCursorW CreateWindowExW GetDesktopWindow SendMessageW DestroyMenu KillTimer IsMenu IsWindow DestroyIcon GetSystemMetrics GetMenuDefaultItem SetTimer GetWindowLongW CallWindowProcW DefWindowProcW GetClassInfoExW SetMenuDefaultItem TrackPopupMenu MapWindowPoints

gdi32

CreateFontIndirectW DeleteObject

advapi32

RegCreateKeyExW RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegOpenKeyExW

shell32

ShellExecuteExW Shell_NotifyIconW

ole32

CoTaskMemAlloc CoTaskMemFree CoInitialize CoUninitialize CoTaskMemRealloc CoCreateInstance

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_91450fa866170cb7ffd52ccf79dd1d73_amadey_coinminer_elex_manuscrypt_rhadamanthys_smoke-loader_stop_virut

PE Signature issue

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

generic