2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry

General

Target
2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry
Size 3.1MB
Sample260916-henbpsgk4t
SHA256 40197266a36d5f1633c4fa1a0b13a947a8d0c685692e007afada1fb2e01beec3
MD5 20636b4a64d1b3dc016bbf16746aec7f
SHA1 c9f73c28271d78995ae28f93a34c764b546ce4df
SHA512 f6a1c8a8e674a52061272ecf7556d101abf1fcca2d9ec3019de78efd0dbd8cf0e1ac056b8851502089a15af053584caa1151ded623bee02057649dbc3fdf07c1
SSDEEP 49152:RU2MotRHZy0trDhzAAwPjtpTwTzQtInKCbshwbpaNNakJBIs7sH2up:RjMov5y0trDaJPjtpGKuSakJByH
TLSH
T1E2E5BF90E7C4D1B3D1414670C1A66BB49AA4FC32FBF4899B65A13F2CAE712C3762D217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry

File Explorer

2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry

.exe 3.1MB

2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry

IMPHASH 761c406b34b7b07b5653199fed9941c7
SHA256 40197266a36d5f1633c4fa1a0b13a947a8d0c685692e007afada1fb2e01beec3
MD5 20636b4a64d1b3dc016bbf16746aec7f
SHA1 c9f73c28271d78995ae28f93a34c764b546ce4df
SHA512 f6a1c8a8e674a52061272ecf7556d101abf1fcca2d9ec3019de78efd0dbd8cf0e1ac056b8851502089a15af053584caa1151ded623bee02057649dbc3fdf07c1
SSDEEP 49152:RU2MotRHZy0trDhzAAwPjtpTwTzQtInKCbshwbpaNNakJBIs7sH2up:RjMov5y0trDaJPjtpGKuSakJByH
TLSH
T1E2E5BF90E7C4D1B3D1414670C1A66BB49AA4FC32FBF4899B65A13F2CAE712C3762D217
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7924

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub __vbaStrI2 ord690 ord691 _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaFreeVar ord588 __vbaAptOffset __vbaStrVarMove __vbaLenBstr __vbaFreeVarList __vbaEnd _adj_fdiv_m64 __vbaFpCDblR8 __vbaFreeObjList ord516 _adj_fprem1 ord518 ord626 __vbaStrCat __vbaForEachCollAd __vbaSetSystemError __vbaHresultCheckObj ord662 _adj_fdiv_m32 __vbaAryVar __vbaAryDestruct __vbaLateMemSt __vbaExitProc ord300 ord301 __vbaObjSet __vbaOnError ord595 ord302 _adj_fdiv_m16i ord303 __vbaObjSetAddref _adj_fdivr_m16i ord598 ord305 ord306 ord520 __vbaBoolVar ord307 ord308 ord309 __vbaBoolVarNull _CIsin ord709 __vbaVarZero ord632 __vbaChkstk EVENT_SINK_AddRef __vbaVarAbs __vbaStrCmp __vbaVarTstEq __vbaR4Str ord561 __vbaObjVar DllFunctionCall __vbaVarLateMemSt ord670 __vbaCastObjVar __vbaLbound __vbaStrR4 __vbaRedimPreserve _adj_fpatan __vbaR4Var __vbaRedim __vbaStrR8 EVENT_SINK_Release __vbaNew ord600 _CIsqrt __vbaLateIdCallSt __vbaObjIs ord311 EVENT_SINK_QueryInterface __vbaVarMul __vbaExceptHandler ord711 ord313 __vbaStrToUnicode ord712 _adj_fprem _adj_fdivr_m64 ord714 __vbaVarDiv __vbaI2Str ord530 ord608 ord716 __vbaFPException __vbaStrVarVal __vbaUbound __vbaVarCat ord535 __vbaI2Var _CIlog __vbaR8Str __vbaNew2 __vbaInStr _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy ord573 ord681 __vbaI4Str __vbaFreeStrList __vbaVarNot _adj_fdivr_m32 __vbaR8Var __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var ord689 __vbaVarCmpEq __vbaVarAdd __vbaAryLock __vbaLateMemCall __vbaStrToAnsi __vbaVarDup __vbaFpI2 __vbaVarLateMemCallLd __vbaFpI4 __vbaVarCopy __vbaLateMemCallLd ord617 _CIatan __vbaStrMove __vbaAryCopy __vbaCastObj ord619 _allmul _CItan __vbaNextEachCollAd ord546 __vbaAryUnlock _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry

msvbvm60

generic