2026-09-04_0381ebac7a80b5757f537f31947e6420_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_0381ebac7a80b5757f537f31947e6420_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 419KB
Sample260905-yd8t1syscs
SHA256 2e0762df731b470403a4eb6c568a20e1a7d8d8ef86253e1f8a586f2d52ba4800
MD5 0381ebac7a80b5757f537f31947e6420
SHA1 6c766f5183eb8a1c0593641428b72665432bcad8
SHA512 42d4e4ca4f16ad60cf5cc9f4abca77841a51934dd46efcc28ac61329e3b0b10e14a4646cd03c0559fc7726895a7bfa102657f536507cd932f48ee3ab2ce32b1f
SSDEEP 6144:66DmGnV0H2LALrYcdwVDL+gqFCcEOkCybEaQRXr9HNdvOa:66D/WiA3YcyVDLjOkx2LIa
TLSH
T162947C29BAE08073C5678576C4E257A6FBB1B52127108ACFA390475A1F237E3BD3531E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_0381ebac7a80b5757f537f31947e6420_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-09-04_0381ebac7a80b5757f537f31947e6420_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 419KB

2026-09-04_0381ebac7a80b5757f537f31947e6420_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 5537b1abd6ccf73ee443949c9bcbba64
SHA256 2e0762df731b470403a4eb6c568a20e1a7d8d8ef86253e1f8a586f2d52ba4800
MD5 0381ebac7a80b5757f537f31947e6420
SHA1 6c766f5183eb8a1c0593641428b72665432bcad8
SHA512 42d4e4ca4f16ad60cf5cc9f4abca77841a51934dd46efcc28ac61329e3b0b10e14a4646cd03c0559fc7726895a7bfa102657f536507cd932f48ee3ab2ce32b1f
SSDEEP 6144:66DmGnV0H2LALrYcdwVDL+gqFCcEOkCybEaQRXr9HNdvOa:66D/WiA3YcyVDLjOkx2LIa
TLSH
T162947C29BAE08073C5678576C4E257A6FBB1B52127108ACFA390475A1F237E3BD3531E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

101855

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadResource FindResourceW FindResourceExW VirtualQuery LoadLibraryW GetSystemDirectoryW SetCurrentDirectoryW ProcessIdToSessionId Sleep CreateProcessW TerminateProcess LoadLibraryA GetVersionExW CreateFileMappingW MapViewOfFile UnmapViewOfFile QueryPerformanceCounter WinExec GetFileSizeEx ReadFile HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection SetHandleCount WriteConsoleW LockResource SizeofResource WideCharToMultiByte CreateThread GetCurrentThread SetThreadPriority SetPriorityClass GetModuleFileNameW ExitProcess SetUnhandledExceptionFilter Process32NextW Process32FirstW CreateToolhelp32Snapshot GetProcAddress OpenProcess MultiByteToWideChar GetCurrentProcessId WriteFile GetTickCount GetCurrentThreadId SetFilePointerEx GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStdHandle RtlUnwind GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP LCMapStringA IsDebuggerPresent UnhandledExceptionFilter LCMapStringW IsValidCodePage GetOEMCP GetStartupInfoW GetACP GetCPInfo GetSystemTimeAsFileTime HeapCreate InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoA CreateFileW GetModuleHandleW GetCurrentProcess OpenMutexW GetLastError CloseHandle CreateMutexW SetFilePointer GetSystemInfo GetModuleHandleA VirtualFree TerminateThread VirtualAlloc VirtualAllocEx WriteProcessMemory CreateRemoteThread GetProcessId SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime GlobalAlloc GlobalFree CreateFileA GetFileType

user32

GetThreadDesktop GetWindowThreadProcessId FindWindowExW FindWindowW wsprintfW OpenDesktopW SetThreadDesktop

advapi32

OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges SetServiceStatus RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW OpenSCManagerW ControlService StartServiceW CreateServiceW FreeSid CheckTokenMembership AllocateAndInitializeSid CreateProcessAsUserW CloseServiceHandle OpenServiceW

shell32

ShellExecuteExW ShellExecuteW

shlwapi

StrCmpIW PathFileExistsW

wininet

InternetOpenW InternetSetOptionW InternetOpenUrlW HttpSendRequestW InternetQueryOptionW InternetSetOptionA HttpOpenRequestW InternetConnectW InternetCloseHandle InternetReadFile

psapi

GetModuleFileNameExW

ws2_32

WSAStartup socket setsockopt inet_addr sendto recvfrom ntohs closesocket inet_ntoa htonl ntohl htons

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

dnsapi

DnsFree DnsQuery_W

iphlpapi

SendARP GetIpNetTable GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_0381ebac7a80b5757f537f31947e6420_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

advapi32

shell32

shlwapi

wininet

psapi

ws2_32

version

dnsapi

iphlpapi

generic