2026-08-04_4127a06ac686e8b0e19a27ffd04bf220_amadey_coinminer_elex_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_4127a06ac686e8b0e19a27ffd04bf220_amadey_coinminer_elex_luca-stealer_njrat_remcos_smoke-loader
Size 606KB
Sample260804-tg8k7shr3x
SHA256 716b7d7cc05ec788a8ede36a3e9fe4fba86cb41c5993153e9a26a3a30017257e
MD5 4127a06ac686e8b0e19a27ffd04bf220
SHA1 7bd447ee05fc13bd863913dd868bb63a7e52506e
SHA512 4d51471fcb2ac0fea1c0b5da694c458ac6de0da1b67a4ba0470b7b27d43d5cd40a362b1a8b5696cc74db50860172f4a729c4b8b214b5a1677f37cf86c5069ffa
SSDEEP 12288:9znxncwgC2hxziDJK9eG9HXzsa/TR8J1in1:kwgDhxzv9H/TR8J1in1
TLSH
T115D40720759AC23AD67195F00A7E8E9A906EBD2C5F710DCB97C00F3A5474ED31A36E72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-04_4127a06ac686e8b0e19a27ffd04bf220_amadey_coinminer_elex_luca-stealer_njrat_remcos_smoke-loader

.exe 606KB

2026-08-04_4127a06ac686e8b0e19a27ffd04bf220_amadey_coinminer_elex_luca-stealer_njrat_remcos_smoke-loader

IMPHASH fe21b64d4798748ccfbfed945b398501
SHA256 716b7d7cc05ec788a8ede36a3e9fe4fba86cb41c5993153e9a26a3a30017257e
MD5 4127a06ac686e8b0e19a27ffd04bf220
SHA1 7bd447ee05fc13bd863913dd868bb63a7e52506e
SHA512 4d51471fcb2ac0fea1c0b5da694c458ac6de0da1b67a4ba0470b7b27d43d5cd40a362b1a8b5696cc74db50860172f4a729c4b8b214b5a1677f37cf86c5069ffa
SSDEEP 12288:9znxncwgC2hxziDJK9eG9HXzsa/TR8J1in1:kwgDhxzv9H/TR8J1in1
TLSH
T115D40720759AC23AD67195F00A7E8E9A906EBD2C5F710DCB97C00F3A5474ED31A36E72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

a1:f2:bd:3b:86:97:8f:2b:9d:65:23:72:ee:5d:c3:f7:c7:69:9c:52:d9:68:75:29:b9:5f:73:d0:96:2c:b0:35

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=913101150729060470,CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13065075646f6e67,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 16, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

53:84:2f:53:67:33:1b:d2:81:db:22:04:86:d3:5d:42:e7:cd:ce:15

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Jul 16, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

03:ec:60:a9:1c:f8:d3:80:ba:4b:64:8b:88:35:79:70

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 28, 2026 - Jul 20, 2027

Minor OS version

Major OS version

Entry point

322758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\zhanlue\rcimage\bin\Win32\Release\dbgsym\2345PicHelper.pdb

kernel32

lstrlenW GetFileAttributesW SetFileAttributesW DeleteFileW MoveFileExW GetTempFileNameW MoveFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection DecodePointer RaiseException InitializeCriticalSectionAndSpinCount GetTickCount OpenProcess GetCurrentProcess GetCurrentProcessId TerminateProcess GetFullPathNameW Sleep MultiByteToWideChar FileTimeToSystemTime LocalFree GlobalAlloc GlobalFree SystemTimeToFileTime IsBadStringPtrW CreateDirectoryW GetFileSize CloseHandle SetEndOfFile SetFilePointer WriteFile ReadFile FindClose FindNextFileW GetLastError CreateFileW LoadLibraryExW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW SetErrorMode WaitForSingleObject GetModuleFileNameW LocalAlloc GetVersionExW GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW OutputDebugStringW RtlUnwind SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP GetStringTypeW HeapFree HeapAlloc GetFileType LCMapStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap HeapSize HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW LockResource LoadResource FindResourceW lstrcmpiW GetEnvironmentVariableW CreateMutexW ReleaseMutex InterlockedExchangeAdd

advapi32

RegQueryValueExW GetUserNameW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus BuildExplicitAccessWithNameW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW RegCreateKeyW RegSetValueExW RegCloseKey RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenCurrentUser

shell32

SHChangeNotify SHGetPathFromIDListW SHGetSpecialFolderLocation

ole32

CoTaskMemFree CoSetProxyBlanket CoInitializeEx CoInitializeSecurity CoUninitialize CoCreateInstance

oleaut32

SysAllocString VariantInit VariantClear VariantChangeType

imm32

ImmDisableIME

shlwapi

SHDeleteKeyW

wtsapi32

WTSQuerySessionInformationW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_4127a06ac686e8b0e19a27ffd04bf220_amadey_coinminer_elex_luca-stealer_njrat_remcos_smoke-loader

kernel32

advapi32

shell32

ole32

oleaut32

imm32

shlwapi

wtsapi32

generic