2026-09-07_b4cd497e3a7ae2c07638c5925498c880_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-07_b4cd497e3a7ae2c07638c5925498c880_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 419KB
Sample260908-jnvb2stycw
SHA256 ea0159bcb575f0b0dafb7d2d62929e0a8c1ff3ec30b1af79f662304589d55ab9
MD5 b4cd497e3a7ae2c07638c5925498c880
SHA1 eccb7824fc0aa841f6a574c79b82437418d58345
SHA512 fa364aa4c21d6f54cfc41244efcb50ea8e3e4b6fe81b6119dc9c62cdc0f1d69a41ab984e377405317030e26b9c394512aa24b2979eb27e3efe406ab85f6e888d
SSDEEP 6144:V6DmGnV0H2LALrYcdwVDL+gqFCcEOkCybEaQRXr9HNdvOa:V6D/WiA3YcyVDLjOkx2LIa
TLSH
T120947C29BAE08073C5678576C4E257A6FBB1B52127108ACFA390475A1F237E3BD3531E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-07_b4cd497e3a7ae2c07638c5925498c880_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-09-07_b4cd497e3a7ae2c07638c5925498c880_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 419KB

2026-09-07_b4cd497e3a7ae2c07638c5925498c880_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 5537b1abd6ccf73ee443949c9bcbba64
SHA256 ea0159bcb575f0b0dafb7d2d62929e0a8c1ff3ec30b1af79f662304589d55ab9
MD5 b4cd497e3a7ae2c07638c5925498c880
SHA1 eccb7824fc0aa841f6a574c79b82437418d58345
SHA512 fa364aa4c21d6f54cfc41244efcb50ea8e3e4b6fe81b6119dc9c62cdc0f1d69a41ab984e377405317030e26b9c394512aa24b2979eb27e3efe406ab85f6e888d
SSDEEP 6144:V6DmGnV0H2LALrYcdwVDL+gqFCcEOkCybEaQRXr9HNdvOa:V6D/WiA3YcyVDLjOkx2LIa
TLSH
T120947C29BAE08073C5678576C4E257A6FBB1B52127108ACFA390475A1F237E3BD3531E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

101855

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadResource FindResourceW FindResourceExW VirtualQuery LoadLibraryW GetSystemDirectoryW SetCurrentDirectoryW ProcessIdToSessionId Sleep CreateProcessW TerminateProcess LoadLibraryA GetVersionExW CreateFileMappingW MapViewOfFile UnmapViewOfFile QueryPerformanceCounter WinExec GetFileSizeEx ReadFile HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection SetHandleCount WriteConsoleW LockResource SizeofResource WideCharToMultiByte CreateThread GetCurrentThread SetThreadPriority SetPriorityClass GetModuleFileNameW ExitProcess SetUnhandledExceptionFilter Process32NextW Process32FirstW CreateToolhelp32Snapshot GetProcAddress OpenProcess MultiByteToWideChar GetCurrentProcessId WriteFile GetTickCount GetCurrentThreadId SetFilePointerEx GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStdHandle RtlUnwind GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP LCMapStringA IsDebuggerPresent UnhandledExceptionFilter LCMapStringW IsValidCodePage GetOEMCP GetStartupInfoW GetACP GetCPInfo GetSystemTimeAsFileTime HeapCreate InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoA CreateFileW GetModuleHandleW GetCurrentProcess OpenMutexW GetLastError CloseHandle CreateMutexW SetFilePointer GetSystemInfo GetModuleHandleA VirtualFree TerminateThread VirtualAlloc VirtualAllocEx WriteProcessMemory CreateRemoteThread GetProcessId SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime GlobalAlloc GlobalFree CreateFileA GetFileType

user32

GetThreadDesktop GetWindowThreadProcessId FindWindowExW FindWindowW wsprintfW OpenDesktopW SetThreadDesktop

advapi32

OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges SetServiceStatus RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW OpenSCManagerW ControlService StartServiceW CreateServiceW FreeSid CheckTokenMembership AllocateAndInitializeSid CreateProcessAsUserW CloseServiceHandle OpenServiceW

shell32

ShellExecuteExW ShellExecuteW

shlwapi

StrCmpIW PathFileExistsW

wininet

InternetOpenW InternetSetOptionW InternetOpenUrlW HttpSendRequestW InternetQueryOptionW InternetSetOptionA HttpOpenRequestW InternetConnectW InternetCloseHandle InternetReadFile

psapi

GetModuleFileNameExW

ws2_32

WSAStartup socket setsockopt inet_addr sendto recvfrom ntohs closesocket inet_ntoa htonl ntohl htons

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

dnsapi

DnsFree DnsQuery_W

iphlpapi

SendARP GetIpNetTable GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-07_b4cd497e3a7ae2c07638c5925498c880_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

advapi32

shell32

shlwapi

wininet

psapi

ws2_32

version

dnsapi

iphlpapi

generic