2026-08-09_82f77822844c20be92d485500cc8e636_amadey_coinminer_elex_floxif_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_82f77822844c20be92d485500cc8e636_amadey_coinminer_elex_floxif_smoke-loader
Size 3.3MB
Sample260809-fyfpvs1dld
SHA256 9868433320db1404f4f448d8a13cac0d1bbddd8c642017672e7954446e777131
MD5 82f77822844c20be92d485500cc8e636
SHA1 91ed5a5a335a64e649d31c75c98b15095518ce7f
SHA512 70c278e19dcc42847776920d8b668e2505a55f0786e501071d4469f8676e66c4737422cfec10b0a8fe5617e44594909d8afa2ac7b6496163a4613b1679210fca
SSDEEP 49152:nHWAyMsLI9Iu6a+H10dIb2muQH10dcb2m4o:WpE9IaRNmuXhm4o
TLSH
T14DF53A1376E95261F5F239B45AB816619A7BBC606B39D68F128C058E4FB3EC0CD30763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_82f77822844c20be92d485500cc8e636_amadey_coinminer_elex_floxif_smoke-loader

File Explorer

2026-08-09_82f77822844c20be92d485500cc8e636_amadey_coinminer_elex_floxif_smoke-loader

.exe 3.3MB

2026-08-09_82f77822844c20be92d485500cc8e636_amadey_coinminer_elex_floxif_smoke-loader

IMPHASH be97487721610c9a026fb02df1179ce2
SHA256 9868433320db1404f4f448d8a13cac0d1bbddd8c642017672e7954446e777131
MD5 82f77822844c20be92d485500cc8e636
SHA1 91ed5a5a335a64e649d31c75c98b15095518ce7f
SHA512 70c278e19dcc42847776920d8b668e2505a55f0786e501071d4469f8676e66c4737422cfec10b0a8fe5617e44594909d8afa2ac7b6496163a4613b1679210fca
SSDEEP 49152:nHWAyMsLI9Iu6a+H10dIb2muQH10dcb2m4o:WpE9IaRNmuXhm4o
TLSH
T14DF53A1376E95261F5F239B45AB816619A7BBC606B39D68F128C058E4FB3EC0CD30763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

536382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

OpenProcessToken StartServiceW OpenServiceW CreateServiceW CloseServiceHandle OpenSCManagerW DeleteService ControlService SetServiceStatus FreeSid CreateRestrictedToken AllocateAndInitializeSid GetTokenInformation CreateProcessWithLogonW CreateProcessAsUserW RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW SetSecurityInfo SetEntriesInAclW GetSecurityInfo AdjustTokenPrivileges LookupPrivilegeValueW InitiateSystemShutdownW RegCloseKey RegCreateKeyExW RegDeleteKeyW RegQueryValueExW RegSetValueExW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegQueryValueExA RegOpenKeyExW RegSetValueExA RegOpenKeyExA SetNamedSecurityInfoW SetEntriesInAclA BuildExplicitAccessWithNameA GetNamedSecurityInfoW RegUnLoadKeyW RegLoadKeyW RegSaveKeyW CryptDestroyHash CryptReleaseContext CryptGetHashParam CryptHashData CryptCreateHash CryptAcquireContextW CheckTokenMembership AbortSystemShutdownW

gdi32

CreateDCA DeleteDC CreateCompatibleBitmap GetDeviceCaps CreateCompatibleDC BitBlt CreateSolidBrush AddFontResourceW GetStockObject SelectObject SetBkMode SetTextColor GetDIBits Polyline GetTextMetricsW Rectangle GetBkColor CreateBitmap CreatePen Ellipse CreateEllipticRgn SetBkColor ExtTextOutW CreateFontW CreateRectRgn GetPixel CombineRgn GetObjectW SelectPalette RealizePalette DeleteObject

kernel32

GetOverlappedResult ConnectNamedPipe GetProcessId GetShortPathNameW WriteFile LoadLibraryExW CreateEventW SetNamedPipeHandleState CreateNamedPipeA FreeEnvironmentStringsW GetEnvironmentStringsW SetFilePointer DuplicateHandle CreatePipe ReadProcessMemory GetVersion GetCommandLineW lstrcmpA LocalFree GetVersionExW CreateMutexA ReleaseMutex WideCharToMultiByte GetFileSizeEx DeleteFileW VirtualFree GetModuleHandleW WriteConsoleW GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDriveStringsW QueryPerformanceFrequency SetCurrentDirectoryW GetCurrentDirectoryW WinExec WriteProcessMemory Process32NextW Process32FirstW CreateToolhelp32Snapshot SetEnvironmentVariableW ExpandEnvironmentStringsW FormatMessageA HeapReAlloc GlobalMemoryStatusEx LockResource LoadResource SizeofResource FindResourceW CopyFileW RemoveDirectoryW MoveFileW GetProcessTimes SetSystemPowerState SetEndOfFile GetLogicalDrives FormatMessageW GetCurrentThreadId QueryPerformanceCounter SetConsoleWindowInfo GetLargestConsoleWindowSize SetFilePointerEx GetSystemTimeAsFileTime DefineDosDeviceW CreateMutexW VirtualAlloc SleepEx QueryDosDeviceW OpenThread WaitNamedPipeW GlobalMemoryStatus InterlockedExchange GetACP GetLocaleInfoA RaiseException LoadLibraryW DeleteCriticalSection FileTimeToSystemTime SystemTimeToFileTime ResetEvent SetEvent GetVolumeNameForVolumeMountPointW GetVolumeInformationW GetDiskFreeSpaceW lstrcmpiA lstrcpyA lstrcpynA SetLocalTime SetEnvironmentVariableA GlobalAddAtomA GetFileAttributesExW DeleteVolumeMountPointW VirtualProtect GetConsoleWindow SetConsoleScreenBufferSize AllocConsole GetFullPathNameW FileTimeToLocalFileTime GetTempPathW LCMapStringA SetVolumeMountPointW GetFileSize EnumResourceNamesW OpenEventW OpenFileMappingW LCMapStringW SetVolumeLabelW CreateHardLinkW FindFirstFileW GetLongPathNameW SetFileAttributesW SetFileTime LocalFileTimeToFileTime GetTimeZoneInformation SetThreadPriority TryEnterCriticalSection TerminateThread WaitForMultipleObjects GlobalDeleteAtom Beep VirtualQueryEx GetThreadContext SetThreadContext VirtualProtectEx SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA GetCPInfo GetOEMCP GetCommandLineA GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetModuleFileNameA IsBadWritePtr HeapCreate HeapDestroy MultiByteToWideChar GetSystemInfo VirtualQuery TlsGetValue TlsSetValue TlsFree TlsAlloc SetStdHandle GetStartupInfoA GetFileType SetHandleCount HeapSize GetVersionExA RtlUnwind CreateJobObjectW AssignProcessToJobObject ResumeThread GetExitCodeProcess TerminateJobObject ExitProcess lstrcatA GetModuleHandleA CreateDirectoryW FindNextFileW FlushFileBuffers FindFirstVolumeW CreateFileW DeviceIoControl FindNextVolumeW FindVolumeClose OpenProcess GetProcessAffinityMask IsBadCodePtr CompareStringA CompareStringW GetProcessHeap HeapFree GetModuleFileNameW SearchPathW GlobalAlloc GlobalLock GlobalUnlock GlobalFree SetLastError CreateFileMappingA OpenFileMappingA TerminateProcess UnmapViewOfFile CreateFileMappingW MapViewOfFile CreateProcessW WaitForSingleObject GetEnvironmentVariableA SetErrorMode GetStdHandle LoadLibraryA GetProcAddress CreateFiber ConvertThreadToFiber DeleteFiber SwitchToFiber GetEnvironmentVariableW GetLocaleInfoW GetCurrentProcess SetProcessWorkingSetSize CreateThread Sleep GetLastError GetCurrentProcessId HeapAlloc lstrlenA lstrcpynW lstrcatW lstrcpyW lstrcmpW lstrcmpiW FindClose ReadFile CloseHandle LeaveCriticalSection EnterCriticalSection MulDiv GetTickCount GetStartupInfoW FreeLibrary lstrlenW InitializeCriticalSection IsBadReadPtr

setupapi

CM_Get_DevNode_Status CM_Request_Device_EjectW CM_Query_And_Remove_SubTreeW CM_Get_Parent SetupDiOpenClassRegKey SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiClassNameFromGuidA SetupDiGetDeviceInstanceIdA SetupDiDestroyDeviceInfoList CM_Reenumerate_DevNode SetupDiSetClassInstallParamsW CM_Locate_DevNodeW SetupDiGetDeviceInstanceIdW SetupDiClassNameFromGuidW SetupDiChangeState

shell32

DragQueryFileW SHChangeNotify SHAppBarMessage SHGetPathFromIDListW SHBrowseForFolderW Shell_NotifyIconW DragAcceptFiles SHFileOperationW ShellExecuteExW SHGetSpecialFolderPathA SHGetSpecialFolderPathW

shlwapi

StrPBrkW StrCmpIW PathMatchSpecW StrStrIW wnsprintfW StrToIntExW StrCpyNW StrCmpNW StrStrW StrRChrW StrChrW StrCmpNIA StrCmpNIW

user32

CreateDialogParamW GetActiveWindow OffsetRect GetFocus DrawIconEx DrawEdge FindWindowExW EnumWindows UpdateWindow IsChild SetCapture ReleaseCapture ShowCursor ScreenToClient DrawIcon SetScrollInfo ScrollWindow SetMenu CreateMenu LoadBitmapW SetWindowRgn CreateIconFromResource FindWindowW WindowFromPoint ChildWindowFromPointEx CopyImage DestroyCursor LoadStringA GetClipboardData CharUpperA IsWindowVisible GetWindowInfo IsWindowEnabled CreateIconFromResourceEx PtInRect LoadImageW GetClassNameW MessageBoxW IsRectEmpty EnumChildWindows OpenClipboard EmptyClipboard SetClipboardData CloseClipboard SetCursorPos FindWindowExA GetForegroundWindow AttachThreadInput GetWindowThreadProcessId IsDialogMessageW GetSysColor DestroyIcon LoadCursorW SetCursor RegisterWindowMessageW SetFocus SetScrollPos GetScrollInfo GetWindowDC IsIconic OpenDesktopW SetThreadDesktop SwitchDesktop CloseDesktop GetMessageW RegisterClassExW DialogBoxParamW DefWindowProcW LoadMenuW DialogBoxIndirectParamW SetParent BeginPaint EndPaint SetLayeredWindowAttributes GetDlgItemTextW GetWindowTextLengthW FillRect RedrawWindow CallWindowProcW GetKeyState GetMenu GetMenuItemCount EndDialog GetSubMenu GetMenuItemID GetMenuStringW ModifyMenuW UnregisterHotKey RegisterHotKey LockWorkStation mouse_event EnumDisplayDevicesW EnumDisplaySettingsW ChangeDisplaySettingsExW InvalidateRect CharToOemA UnhookWindowsHookEx SetWindowsHookExW GetAsyncKeyState PostQuitMessage CallNextHookEx GetKeyboardState keybd_event RegisterDeviceNotificationW ExitWindowsEx SendMessageTimeoutW IsWindow CharUpperW LoadStringW GetCursorPos CreatePopupMenu TrackPopupMenu DestroyMenu wsprintfA WaitForInputIdle AppendMenuW MessageBoxA FindWindowA GetLastInputInfo PeekMessageW TranslateMessage DispatchMessageW SystemParametersInfoW GetSystemMenu EnableMenuItem GetWindowLongW GetClientRect wsprintfW DrawTextW GetSystemMetrics ShowScrollBar EnableWindow GetDesktopWindow SetActiveWindow SetForegroundWindow BringWindowToTop GetWindowTextW SetWindowTextW ClientToScreen MoveWindow CreateWindowExW SetWindowLongW GetDlgCtrlID GetParent LoadIconW ReleaseDC GetDC SetDlgItemTextW DestroyWindow GetDlgItem SetWindowPos ShowWindow GetWindowRect KillTimer SetTimer SendMessageW PostMessageW MsgWaitForMultipleObjects

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_82f77822844c20be92d485500cc8e636_amadey_coinminer_elex_floxif_smoke-loader

advapi32

gdi32

kernel32

setupapi

shell32

shlwapi

user32

version

generic