2026-09-23_9b4afcfddd293b6b0c799f3ea19c025b_amadey_coinminer_elex_floxif_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_9b4afcfddd293b6b0c799f3ea19c025b_amadey_coinminer_elex_floxif_remcos_smoke-loader_stop
Size 1.5MB
Sample260923-y79cmscb84
SHA256 f116e43bcd4ee1e7e7df776882328eb674ba07cb7aa26fc59186fbb4ece1933e
MD5 9b4afcfddd293b6b0c799f3ea19c025b
SHA1 07f8b4d84d4eb9ce8b43df234d6a160824cafae9
SHA512 240244a27dd9a4207d3ddc81a65ecf04b932d2a78b91ccb803f807888e4ffc1b5a0c08ab3ffb9f91c1257e5f0f2936a3edecd96250cc8006cff5dec6c454f35d
SSDEEP 24576:ZHuYItC2mycFYDaqST1zj1SqdAGFQZIxpK545UJoeJorEH7D:ijcFY2qShzjYq+ZIya5UJoep
TLSH
T13575BF0E779A522BD5B36534DB7682246E6BBE50071587C3E3E07A490F38DE17D322A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-23_9b4afcfddd293b6b0c799f3ea19c025b_amadey_coinminer_elex_floxif_remcos_smoke-loader_stop

File Explorer

2026-09-23_9b4afcfddd293b6b0c799f3ea19c025b_amadey_coinminer_elex_floxif_remcos_smoke-loader_stop

.exe 1.5MB

2026-09-23_9b4afcfddd293b6b0c799f3ea19c025b_amadey_coinminer_elex_floxif_remcos_smoke-loader_stop

IMPHASH 9d4b6d30f44803511871d8218eb97cd0
SHA256 f116e43bcd4ee1e7e7df776882328eb674ba07cb7aa26fc59186fbb4ece1933e
MD5 9b4afcfddd293b6b0c799f3ea19c025b
SHA1 07f8b4d84d4eb9ce8b43df234d6a160824cafae9
SHA512 240244a27dd9a4207d3ddc81a65ecf04b932d2a78b91ccb803f807888e4ffc1b5a0c08ab3ffb9f91c1257e5f0f2936a3edecd96250cc8006cff5dec6c454f35d
SSDEEP 24576:ZHuYItC2mycFYDaqST1zj1SqdAGFQZIxpK545UJoeJorEH7D:ijcFY2qShzjYq+ZIya5UJoep
TLSH
T13575BF0E779A522BD5B36534DB7682246E6BBE50071587C3E3E07A490F38DE17D322A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8b:aa:f0:50:6e:69:e8:aa:f2:fd:99:6b:44:45:aa:f1:26:ee:7d:3f:33:c1:b6:b1:62:5f:a2:71:27:63:8f:54

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=QIHU 360 SOFTWARE CO. LIMITED,OU=Client Security Group,O=QIHU 360 SOFTWARE CO. LIMITED,L=Hong Kong,ST=Hong Kong,C=HK

Chains

Apr 28, 2018

CN=QIHU 360 SOFTWARE CO. LIMITED,OU=Client Security Group,O=QIHU 360 SOFTWARE CO. LIMITED,L=Hong Kong,ST=Hong Kong,C=HK

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

06:13:c3:14:e9:1d:b7:17:44:1a:1a:f8:2e:ed:e0:e0:ff:27:00:4a

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=QIHU 360 SOFTWARE CO. LIMITED,OU=Client Security Group,O=QIHU 360 SOFTWARE CO. LIMITED,L=Hong Kong,ST=Hong Kong,C=HK

Chains

Apr 28, 2018

CN=QIHU 360 SOFTWARE CO. LIMITED,OU=Client Security Group,O=QIHU 360 SOFTWARE CO. LIMITED,L=Hong Kong,ST=Hong Kong,C=HK

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=QIHU 360 SOFTWARE CO. LIMITED,OU=Client Security Group,O=QIHU 360 SOFTWARE CO. LIMITED,L=Hong Kong,ST=Hong Kong,C=HK

Serial Number

54:92:38:03:40:3d:c0:8b:e2:4f:0d:7c:8c:cc:55:93

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 15, 2016 - May 2, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=QIHU 360 SOFTWARE CO. LIMITED,OU=Client Security Group,O=QIHU 360 SOFTWARE CO. LIMITED,L=Hong Kong,ST=Hong Kong,C=HK

Serial Number

30:d2:67:84:66:ae:9b:33:28:5f:1a:53:17:2f:ec:17

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 1, 2016 - May 2, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

Major OS version

Entry point

343252

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\232270\out\Release\360Installer.pdb

kernel32

lstrlenW InterlockedDecrement InterlockedIncrement DebugBreak OutputDebugStringW lstrlenA TerminateThread CloseHandle CreateFileW ReadFile CreateEventW MultiByteToWideChar GetVersionExW GetVersion GetProcAddress GetModuleHandleW FreeLibrary lstrcmpiW LeaveCriticalSection RaiseException EnterCriticalSection GetLastError SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSection DeleteCriticalSection LockResource FreeResource GetCurrentThreadId GetCommandLineW LocalFree GetSystemDirectoryW LoadLibraryW SetFilePointer GetCurrentProcessId DeviceIoControl GetUserDefaultUILanguage GetTempPathW SetEnvironmentVariableW Sleep GetCurrentProcess FlushInstructionCache SetLastError GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetFileSizeEx GetLogicalDriveStringsW GetDriveTypeW GetTempFileNameW DeleteFileW GetDiskFreeSpaceExW QueryDosDeviceW OpenProcess MulDiv GetPrivateProfileStringW GetTickCount CreateProcessW GetModuleFileNameA CreateToolhelp32Snapshot MoveFileExW FindClose GetFullPathNameW FindFirstFileW lstrcpyW FindNextFileW RemoveDirectoryW FreeConsole Process32FirstW Process32NextW WideCharToMultiByte SetEvent CreateMutexW WaitForSingleObject GetLogicalDrives WriteFile LocalAlloc InterlockedCompareExchange CreateFileA GetFileSize FindResourceExW InterlockedExchange LoadLibraryA HeapFree GetProcessHeap HeapAlloc IsProcessorFeaturePresent VirtualFree VirtualAlloc SystemTimeToFileTime GetSystemTimeAsFileTime LocalFileTimeToFileTime SetEndOfFile SetFilePointerEx FormatMessageW GetSystemTime TlsGetValue TlsSetValue GetAtomNameW OpenThread AddAtomW ReleaseMutex TlsAlloc FindAtomW DeleteAtom TlsFree lstrcmpA lstrcmpiA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread ExitProcess GetStartupInfoW RtlUnwind LCMapStringA LCMapStringW GetCPInfo HeapReAlloc HeapSize HeapCreate HeapDestroy GetACP GetOEMCP IsValidCodePage GetStdHandle GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetModuleHandleA SetStdHandle GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_9b4afcfddd293b6b0c799f3ea19c025b_amadey_coinminer_elex_floxif_remcos_smoke-loader_stop

PE Signature issue

PE Signature issue

kernel32

generic