shodi | 2026-08-03_88aa2607779525f2eabccdb014303597_amadey_coinminer_rhadamanthys_smoke-loader

General

Target
2026-08-03_88aa2607779525f2eabccdb014303597_amadey_coinminer_rhadamanthys_smoke-loader
Size 6.9MB
Sample260803-znj43sbp21
SHA256 61851a7e4bfc25e56329831a0ff5be71a3a53545839da5193a9cf81ef5e752c7
MD5 88aa2607779525f2eabccdb014303597
SHA1 ca50a51c5261140df3c9ca52b9d84e6025affe81
SHA512 0fd54011af9cab37512df3cb303fcaf529895dbb8f0ff013827cbc1047a5f32c3d9e8b350237a33225ade03081d7e917e739687f9e1dfdeb253af0e9fe9879c1
SSDEEP 196608:B13fZP8v13fZP8v13fZP8q13fZP8q13fZP8v13fZP8l13fZP8S13fZP8v13fZP8i:bqhqhqwqwqhqXqoqhqh0
TLSH
T17A767D32E5514037D7E102B3AD28A6307E7DA3286B5088A797D4ED1D7EB44D3ABB7207
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm shodi

Malware Config

Signatures

Family: Shodi
Shodi is a Windows worm written in C++.
worm shodi

Detects Shodi worm 1 IoCs

resource	yara_rule
sample	family_shodi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_88aa2607779525f2eabccdb014303597_amadey_coinminer_rhadamanthys_smoke-loader

File Explorer

2026-08-03_88aa2607779525f2eabccdb014303597_amadey_coinminer_rhadamanthys_smoke-loader

.exe 6.9MB

2026-08-03_88aa2607779525f2eabccdb014303597_amadey_coinminer_rhadamanthys_smoke-loader

SHA256 61851a7e4bfc25e56329831a0ff5be71a3a53545839da5193a9cf81ef5e752c7
MD5 88aa2607779525f2eabccdb014303597
SHA1 ca50a51c5261140df3c9ca52b9d84e6025affe81
SHA512 0fd54011af9cab37512df3cb303fcaf529895dbb8f0ff013827cbc1047a5f32c3d9e8b350237a33225ade03081d7e917e739687f9e1dfdeb253af0e9fe9879c1
SSDEEP 196608:B13fZP8v13fZP8v13fZP8q13fZP8q13fZP8v13fZP8l13fZP8S13fZP8v13fZP8i:bqhqhqwqwqhqXqoqhqh0
TLSH
T17A767D32E5514037D7E102B3AD28A6307E7DA3286B5088A797D4ED1D7EB44D3ABB7207
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Shodi worm
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

3976592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

337KB

Virtual Size

336KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

213KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=257, version=25305,

count=2, id=259, version=25305,

count=12, id=260, version=25305,

count=37, id=261, version=25305,

count=2, id=257, productName=VS2017 v15.3 build 25506, version=25506,

count=8, id=109, productName=VS2005 build 50727, version=50727,

count=1, id=125, productName=VS2005 build 50727, version=50727,

count=1, id=259, version=25203,

count=2, id=263, version=25203,

count=4, id=262, version=25203,

count=15, id=260, version=25203,

count=27, id=257, version=25203,

count=1263, id=1, productName=Unmarked objects,

count=17, id=260, productName=VS2017 v15.3 build 25506, version=25506,

count=2, id=259, productName=VS2017 v15.3 build 25506, version=25506,

count=1375, id=261, productName=VS2017 v15.3 build 25506, version=25506,

count=1, id=255, productName=VS2017 v15.3 build 25506, version=25506,

count=1, id=258, productName=VS2017 v15.3 build 25506, version=25506,

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_88aa2607779525f2eabccdb014303597_amadey_coinminer_rhadamanthys_smoke-loader

generic