2026-09-29_7687a51d3d3bf2c648c0ad7560364d6e_amadey_coinminer_elex_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_7687a51d3d3bf2c648c0ad7560364d6e_amadey_coinminer_elex_smoke-loader_stealc_stop_tofsee
Size 2.9MB
Sample260929-12cslaytez
SHA256 8464d77d9600ca1796487240505c29cbfc117c7b0140672858c9d63cdf3ab097
MD5 7687a51d3d3bf2c648c0ad7560364d6e
SHA1 adb449e29072bbc2d0ac265dfa2aaeeaeb52b458
SHA512 6a2825dd0c716a2c3dd4de59add77fb3aaf5086732555167682784bdd197ac0678889e347ad61f57402b3cf03b17186f2af4a7f9c883801fbc24ed4c0dfbde46
SSDEEP 49152:Ug0DDIhxSMmT8oWgBCaXBarSj8RoTCChhxSMmT8oWgBCaX:OD8+M4FHXBJTt+M4FHX
TLSH
T11FE52232BBC5D072E8371634DAE5D7F559AE7DA8C31241CBAB943F6C7930AC1193A212
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_7687a51d3d3bf2c648c0ad7560364d6e_amadey_coinminer_elex_smoke-loader_stealc_stop_tofsee

File Explorer

2026-09-29_7687a51d3d3bf2c648c0ad7560364d6e_amadey_coinminer_elex_smoke-loader_stealc_stop_tofsee

.exe 2.9MB

2026-09-29_7687a51d3d3bf2c648c0ad7560364d6e_amadey_coinminer_elex_smoke-loader_stealc_stop_tofsee

IMPHASH 0e7bacecff7e863cf8e303294e31028b
SHA256 8464d77d9600ca1796487240505c29cbfc117c7b0140672858c9d63cdf3ab097
MD5 7687a51d3d3bf2c648c0ad7560364d6e
SHA1 adb449e29072bbc2d0ac265dfa2aaeeaeb52b458
SHA512 6a2825dd0c716a2c3dd4de59add77fb3aaf5086732555167682784bdd197ac0678889e347ad61f57402b3cf03b17186f2af4a7f9c883801fbc24ed4c0dfbde46
SSDEEP 49152:Ug0DDIhxSMmT8oWgBCaXBarSj8RoTCChhxSMmT8oWgBCaX:OD8+M4FHXBJTt+M4FHX
TLSH
T11FE52232BBC5D072E8371634DAE5D7F559AE7DA8C31241CBAB943F6C7930AC1193A212
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

97556

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\VSE3\BUILD\vse\Release\shstat.pdb

ftcfg

VirusNameExclusionCreate VirusNameListCreate

shutil

Shutil_SplashScreen REG_GetOpt REG_OpenKeyEx REG_CloseKey REG_SetValueEx REG_QueryValueEx OMP_NotifyUser OMP_FileExists VseGetLocalMachineAboutInfo REG_ConnectComputer DisplayCMASchedDialog REG_OpenEx IsAMD64 IsIA64 IsWebBrowserInstalled GetComponentPath LaunchWebHelp Sh_HtmlHelp GetGraphicsModuleHandle AboutDialogBox2 BetaDialog UIP

rpcrt4

RpcStringBindingComposeW NdrClientCall2 RpcBindingFromStringBindingW

psapi

EnumProcesses GetModuleFileNameExW

lz32

LZRead LZSeek LZClose LZOpenFileW

comctl32

ord17 ImageList_Create ImageList_ReplaceIcon CreateStatusWindowW

userenv

UnloadUserProfile DestroyEnvironmentBlock CreateEnvironmentBlock LoadUserProfileW

wtsapi32

WTSQuerySessionInformationW

kernel32

Sleep MapViewOfFile UnmapViewOfFile WaitForSingleObject GetSystemTimeAsFileTime OpenProcess FormatMessageW GetLastError ResetEvent CreateEventW WaitForMultipleObjects OpenFileMappingW OpenEventW GetLocalTime LocalUnlock LocalLock LocalAlloc LocalFree SystemTimeToFileTime GetVersionExW HeapAlloc HeapFree GetProcessHeap ExitProcess GetCommandLineW GlobalDeleteAtom CreateMutexW SetFilePointer FreeLibrary SetWaitableTimer GetCurrentProcess GetComputerNameW LoadLibraryW TerminateProcess ReadFile CreateFileW GetProcAddress SetCurrentDirectoryW GlobalGetAtomNameW SetProcessWorkingSetSize DeviceIoControl CreateWaitableTimerW GetWindowsDirectoryW GetVersion GetCurrentProcessId GlobalAddAtomW ExpandEnvironmentStringsW PulseEvent LoadLibraryExW GetCurrentThread GetModuleFileNameW FileTimeToLocalFileTime FindClose MulDiv GetOEMCP InterlockedIncrement InterlockedDecrement GetTickCount WriteFile GetStdHandle FindNextFileW GetCurrentThreadId GetUserDefaultLCID FindFirstFileExW GetSystemDefaultLCID GetThreadLocale TlsGetValue InitializeCriticalSection TlsSetValue LeaveCriticalSection InterlockedExchange EnterCriticalSection DeleteCriticalSection TlsAlloc DebugBreak MultiByteToWideChar FreeEnvironmentStringsA HeapSize SetLastError TlsFree IsValidCodePage GetACP GetCPInfo GetModuleFileNameA VirtualAlloc VirtualFree HeapCreate IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter HeapReAlloc GetStartupInfoA GetCommandLineA FileTimeToSystemTime GetTimeFormatW SetEvent CreateProcessW GetDateFormatW IsBadReadPtr GetModuleHandleW CreateThread CloseHandle GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter LCMapStringW LCMapStringA InitializeCriticalSectionAndSpinCount RtlUnwind LoadLibraryA GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers CreateFileA FindFirstFileW RaiseException

user32

GetMenuItemCount EnumChildWindows GetMenuItemInfoW GetSubMenu GetMenuItemID IsChild SetMenuItemInfoW GetMenuDefaultItem GetMenuState SetMenuDefaultItem DestroyWindow SetActiveWindow PostQuitMessage RegisterWindowMessageW PostMessageW LoadCursorW FindWindowW EnumWindows RegisterClassW UpdateWindow DefWindowProcW GetWindowThreadProcessId GetForegroundWindow GetDesktopWindow GetShellWindow GetSystemMenu SetTimer DrawTextW KillTimer GetLastActivePopup DialogBoxIndirectParamW SetRect GetWindowTextW SystemParametersInfoW GetClassNameW SetWindowLongW EndDialog RedrawWindow GetActiveWindow IsWindow MessageBoxW GetSystemMetrics GetDialogBaseUnits MoveWindow IsIconic SetForegroundWindow IsWindowVisible wsprintfW LoadStringW GetDC LoadIconW ReleaseDC RemoveMenu SetWindowTextW TranslateAcceleratorW GetMessageW GetMenuStringW SetFocus TranslateMessage LoadAcceleratorsW GetMenu IsDialogMessageW TrackPopupMenuEx GetWindowLongW EnableMenuItem ShowWindow CreatePopupMenu CreateDialogParamW DestroyMenu CheckMenuItem DispatchMessageW ScreenToClient GetWindowRect LoadImageW GetParent IsWindowEnabled GetClientRect PtInRect InvalidateRect GetDlgItem SendDlgItemMessageW SetWindowPos GetCursorPos CreateWindowExW SetDlgItemTextW EnableWindow SendMessageW AppendMenuW

gdi32

GetTextMetricsW GetTextExtentPoint32W DeleteDC CreateDCW SelectObject GetDeviceCaps CreateFontIndirectW DeleteObject GetObjectW

advapi32

OpenProcessToken InitializeSecurityDescriptor GetUserNameW GetTokenInformation CreateProcessAsUserW DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf AddAccessDeniedAce InitializeAcl AllocateAndInitializeSid AddAccessAllowedAce IsValidSid FreeSid GetLengthSid RegisterEventSourceW SetEntriesInAclW ReportEventW CloseEventLog RegNotifyChangeKeyValue OpenThreadToken EqualSid ImpersonateSelf SetSecurityDescriptorDacl RegCreateKeyExW RegCloseKey RegSetValueExW RegQueryValueExW RegOpenKeyExW GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority

shell32

CommandLineToArgvW Shell_NotifyIconW ShellExecuteW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_7687a51d3d3bf2c648c0ad7560364d6e_amadey_coinminer_elex_smoke-loader_stealc_stop_tofsee

ftcfg

shutil

rpcrt4

psapi

lz32

comctl32

userenv

wtsapi32

kernel32

user32

gdi32

advapi32

shell32

generic