2026-09-24_66b3f1a263dbd5adfba539397b4a2d07_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz

General

Target
2026-09-24_66b3f1a263dbd5adfba539397b4a2d07_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz
Size 6.0MB
Sample260925-j4c3pstamd
SHA256 c2ba3ac0d858135ff80caa65eb3db6e0368c65984846683196929f37c5bf9de7
MD5 66b3f1a263dbd5adfba539397b4a2d07
SHA1 008bf50bfe087bd4bb0e37b662d366554b6b78c4
SHA512 4f4373663c96196995bfec009c1228ce5c5a0514ee67d51fe3c74abb6bbdf5391d14953397f2a0338d5cda73257f631d5bea2477b93449e8b35b45056b7f98cc
SSDEEP 49152:vrl68V/6Rdr8BZ2T516VbpmRMv2M+sOD4iuJ46/EwMg3vAdNXoqvsTrIS7at44es:vrlVyRGnVAmv2vsODEZMg34DXoqvje
TLSH
T19C569D72B6C6F03DE2BFD171482BD2099672BD7045308ABB7F987A197AF0581953A313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_66b3f1a263dbd5adfba539397b4a2d07_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz

File Explorer

2026-09-24_66b3f1a263dbd5adfba539397b4a2d07_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz

.exe 6.0MB

2026-09-24_66b3f1a263dbd5adfba539397b4a2d07_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz

SHA256 c2ba3ac0d858135ff80caa65eb3db6e0368c65984846683196929f37c5bf9de7
MD5 66b3f1a263dbd5adfba539397b4a2d07
SHA1 008bf50bfe087bd4bb0e37b662d366554b6b78c4
SHA512 4f4373663c96196995bfec009c1228ce5c5a0514ee67d51fe3c74abb6bbdf5391d14953397f2a0338d5cda73257f631d5bea2477b93449e8b35b45056b7f98cc
SSDEEP 49152:vrl68V/6Rdr8BZ2T516VbpmRMv2M+sOD4iuJ46/EwMg3vAdNXoqvsTrIS7at44es:vrlVyRGnVAmv2vsODEZMg34DXoqvje
TLSH
T19C569D72B6C6F03DE2BFD171482BD2099672BD7045308ABB7F987A197AF0581953A313
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

1986266

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

generic

count=2, id=225, version=20806,

count=4, id=199, version=41118,

count=46, id=223, productName=VS2013 build 21005, version=21005,

count=89, id=225, productName=VS2013 build 21005, version=21005,

count=289, id=224, productName=VS2013 build 21005, version=21005,

count=4, id=14, version=7299,

count=203, id=224, productName=VS2013 UPD3 build 30723, version=30723,

count=35, id=229, version=30723,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=679, id=1, productName=Unmarked objects,

count=357, id=225, productName=VS2013 UPD3 build 30723, version=30723,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=3, id=151,

count=1, id=222, productName=VS2013 UPD3 build 30723, version=30723,

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_66b3f1a263dbd5adfba539397b4a2d07_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz

generic