2026-08-11_46cb3d311b2ee74533f4190ed60147df_amadey_coinminer_elex_floxif_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_46cb3d311b2ee74533f4190ed60147df_amadey_coinminer_elex_floxif_remcos_smoke-loader
Size 1.5MB
Sample260811-sffncseh79
SHA256 46c9cd2d421cb8ce28eeccf88df384f583917e29176acb2dd1d21e8857e5d798
MD5 46cb3d311b2ee74533f4190ed60147df
SHA1 e4a6b57c9ec99c9b2aab48165dc2e886a06afbfd
SHA512 dc8ad17ccc83a3d29e3a78f058e4602f7d1d834fe3c6fa876d8b66b7fe0cf0f4ec8c620c1143dea3130739e448c0037ac738107494cc410ae2f486c6bcd71bd2
SSDEEP 24576:eRByOwtmk9pdd9XAPhFTrZFA1upbVWYbaYU/Jw5cE86fC/SXFtD5LHtvo6rEH7t:oByYkR7ATZe0b9uYUm5cEltD5LHtv+
TLSH
T17A759E70BB61C233E4A200F2DE7C6E6E682DD975131540D7E3D91BA90E754E22A3A35F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-11_46cb3d311b2ee74533f4190ed60147df_amadey_coinminer_elex_floxif_remcos_smoke-loader

File Explorer

2026-08-11_46cb3d311b2ee74533f4190ed60147df_amadey_coinminer_elex_floxif_remcos_smoke-loader

.exe 1.5MB

2026-08-11_46cb3d311b2ee74533f4190ed60147df_amadey_coinminer_elex_floxif_remcos_smoke-loader

IMPHASH 79b0467f1513a01e74822101f82b8c8c
SHA256 46c9cd2d421cb8ce28eeccf88df384f583917e29176acb2dd1d21e8857e5d798
MD5 46cb3d311b2ee74533f4190ed60147df
SHA1 e4a6b57c9ec99c9b2aab48165dc2e886a06afbfd
SHA512 dc8ad17ccc83a3d29e3a78f058e4602f7d1d834fe3c6fa876d8b66b7fe0cf0f4ec8c620c1143dea3130739e448c0037ac738107494cc410ae2f486c6bcd71bd2
SSDEEP 24576:eRByOwtmk9pdd9XAPhFTrZFA1upbVWYbaYU/Jw5cE86fC/SXFtD5LHtvo6rEH7t:oByYkR7ATZe0b9uYUm5cEltD5LHtv+
TLSH
T17A759E70BB61C233E4A200F2DE7C6E6E682DD975131540D7E3D91BA90E754E22A3A35F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

0c:58:01:2f:30:39:45:82:98:2c:36:f2:e2:23:55:3e:e8:97:54:ce:86:2d:08:68:3e:48:99:84:ca:54:28:5f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=Zhuhai,ST=Guangdong,C=CN

Chains

Aug 5, 2020

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=Zhuhai,ST=Guangdong,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

19:23:ba:28:03:b1:6a:bc:27:9f:c2:af:88:51:80:8b:47:99:81:9e

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=Zhuhai,ST=Guangdong,C=CN

Chains

Aug 5, 2020

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=Zhuhai,ST=Guangdong,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=Zhuhai,ST=Guangdong,C=CN

Serial Number

02:e4:4d:7d:1d:38:ae:22:3b:27:a0:2b:ac:d7:9b:53

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 20, 2020 - Feb 4, 2023

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=Zhuhai,ST=Guangdong,C=CN

Serial Number

04:18:68:dd:49:84:0f:f4:4f:8e:3d:30:70:56:83:50

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 20, 2020 - Feb 4, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

760527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\pre_i18_per_to_202007_061\Build\Release\WPSOffice\office6\wpscloudsvr.pdb

kernel32

GetModuleFileNameW GetProcAddress GetModuleHandleW CloseHandle TerminateProcess OpenProcess Process32NextW Process32FirstW GetCurrentProcessId CreateToolhelp32Snapshot GetLastError Sleep GetCurrentThreadId FreeLibrary LoadLibraryA GetCommandLineW EnterCriticalSection LeaveCriticalSection UnregisterWaitEx InterlockedDecrement WaitForMultipleObjects DeleteFileW InitializeCriticalSection QueueUserWorkItem InterlockedIncrement WaitForSingleObject DeleteCriticalSection CreateThread LocalFree GetStartupInfoW GetTickCount GetTempPathW CopyFileW LoadLibraryW SetDllDirectoryW GetDllDirectoryW SystemTimeToFileTime GetSystemTime DisconnectNamedPipe ConnectNamedPipe FlushFileBuffers ReadFile CreateIoCompletionPort CreateNamedPipeW WriteFile GetQueuedCompletionStatus PostQueuedCompletionStatus GetOverlappedResult CancelIo InterlockedExchange WaitNamedPipeW CreateFileW SetNamedPipeHandleState GetExitCodeProcess GetVersionExW LocalAlloc GetCurrentProcess GetSystemDirectoryW GetSystemWow64DirectoryW MultiByteToWideChar WideCharToMultiByte CreateDirectoryW GetFileAttributesW GetPrivateProfileStringW CreateProcessW GetProcessId SetUnhandledExceptionFilter SizeofResource LockResource LoadResource FindResourceW FindResourceExW lstrlenW OutputDebugStringW VerifyVersionInfoW VerSetConditionMask SetEvent CreateEventW VirtualAlloc VirtualFree GetFileAttributesExW GetSystemInfo LoadLibraryExW RaiseException GetPrivateProfileIntW SetFilePointerEx GetFileSizeEx FileTimeToSystemTime CompareFileTime SystemTimeToTzSpecificLocalTime FindClose FindFirstFileW FindNextFileW ExpandEnvironmentStringsW GetCurrentThread ProcessIdToSessionId GetCompressedFileSizeW CreateSemaphoreW ReleaseSemaphore InitializeCriticalSectionAndSpinCount FlushViewOfFile InterlockedCompareExchange GetProcessHeap OutputDebugStringA WaitForSingleObjectEx UnmapViewOfFile UnlockFileEx UnlockFile SetFilePointer SetEndOfFile QueryPerformanceCounter MapViewOfFile LockFileEx LockFile HeapCompact HeapValidate HeapSize HeapReAlloc HeapFree HeapDestroy HeapCreate HeapAlloc GetVersionExA GetTempPathA GetSystemTimeAsFileTime GetFullPathNameW GetFullPathNameA GetFileSize GetFileAttributesA GetDiskFreeSpaceW GetDiskFreeSpaceA FormatMessageW FormatMessageA DeleteFileA CreateMutexW CreateFileMappingW CreateFileMappingA CreateFileA AreFileApisANSI TryEnterCriticalSection GetStringTypeW EncodePointer DecodePointer HeapSetInformation RtlUnwind SetConsoleCtrlHandler UnhandledExceptionFilter IsDebuggerPresent ExitThread LCMapStringW GetCPInfo ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError IsProcessorFeaturePresent SetEnvironmentVariableA SetEnvironmentVariableW GetACP GetOEMCP IsValidCodePage GetLocaleInfoW GetTimeZoneInformation GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CompareStringW GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_46cb3d311b2ee74533f4190ed60147df_amadey_coinminer_elex_floxif_remcos_smoke-loader

PE Signature issue

PE Signature issue

kernel32

generic