2026-09-29_db7083e000cb4e1463262ef51075d4f1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_db7083e000cb4e1463262ef51075d4f1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 419KB
Sample260929-sr4vbsteng
SHA256 302b74bdb401eef5aeaed53cca42c3b74c2807c88420281454a3dcd11e486b7d
MD5 db7083e000cb4e1463262ef51075d4f1
SHA1 236b260a5e0683ed4b354d074470a0224710955b
SHA512 80d6fdaef269d6e413276ce847d0cf9b1c15d3400ffe0013257ceba81917b17f8e732029dcd5b76b9dbb58fd5321b7e5c25d8ee4fbd6bad82c4d3f66a8cdfd87
SSDEEP 6144:r6DmGnV0H2LALrYcdwVDL+gqFCcEOkCybEaQRXr9HNdvOa:r6D/WiA3YcyVDLjOkx2LIa
TLSH
T1B3947C29BAE08073C5678576C4E257A6FBB1B52127108ACFA390475A1F237E3BD3531E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_db7083e000cb4e1463262ef51075d4f1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-09-29_db7083e000cb4e1463262ef51075d4f1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 419KB

2026-09-29_db7083e000cb4e1463262ef51075d4f1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 5537b1abd6ccf73ee443949c9bcbba64
SHA256 302b74bdb401eef5aeaed53cca42c3b74c2807c88420281454a3dcd11e486b7d
MD5 db7083e000cb4e1463262ef51075d4f1
SHA1 236b260a5e0683ed4b354d074470a0224710955b
SHA512 80d6fdaef269d6e413276ce847d0cf9b1c15d3400ffe0013257ceba81917b17f8e732029dcd5b76b9dbb58fd5321b7e5c25d8ee4fbd6bad82c4d3f66a8cdfd87
SSDEEP 6144:r6DmGnV0H2LALrYcdwVDL+gqFCcEOkCybEaQRXr9HNdvOa:r6D/WiA3YcyVDLjOkx2LIa
TLSH
T1B3947C29BAE08073C5678576C4E257A6FBB1B52127108ACFA390475A1F237E3BD3531E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

101855

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadResource FindResourceW FindResourceExW VirtualQuery LoadLibraryW GetSystemDirectoryW SetCurrentDirectoryW ProcessIdToSessionId Sleep CreateProcessW TerminateProcess LoadLibraryA GetVersionExW CreateFileMappingW MapViewOfFile UnmapViewOfFile QueryPerformanceCounter WinExec GetFileSizeEx ReadFile HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection SetHandleCount WriteConsoleW LockResource SizeofResource WideCharToMultiByte CreateThread GetCurrentThread SetThreadPriority SetPriorityClass GetModuleFileNameW ExitProcess SetUnhandledExceptionFilter Process32NextW Process32FirstW CreateToolhelp32Snapshot GetProcAddress OpenProcess MultiByteToWideChar GetCurrentProcessId WriteFile GetTickCount GetCurrentThreadId SetFilePointerEx GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStdHandle RtlUnwind GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP LCMapStringA IsDebuggerPresent UnhandledExceptionFilter LCMapStringW IsValidCodePage GetOEMCP GetStartupInfoW GetACP GetCPInfo GetSystemTimeAsFileTime HeapCreate InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoA CreateFileW GetModuleHandleW GetCurrentProcess OpenMutexW GetLastError CloseHandle CreateMutexW SetFilePointer GetSystemInfo GetModuleHandleA VirtualFree TerminateThread VirtualAlloc VirtualAllocEx WriteProcessMemory CreateRemoteThread GetProcessId SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime GlobalAlloc GlobalFree CreateFileA GetFileType

user32

GetThreadDesktop GetWindowThreadProcessId FindWindowExW FindWindowW wsprintfW OpenDesktopW SetThreadDesktop

advapi32

OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges SetServiceStatus RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW OpenSCManagerW ControlService StartServiceW CreateServiceW FreeSid CheckTokenMembership AllocateAndInitializeSid CreateProcessAsUserW CloseServiceHandle OpenServiceW

shell32

ShellExecuteExW ShellExecuteW

shlwapi

StrCmpIW PathFileExistsW

wininet

InternetOpenW InternetSetOptionW InternetOpenUrlW HttpSendRequestW InternetQueryOptionW InternetSetOptionA HttpOpenRequestW InternetConnectW InternetCloseHandle InternetReadFile

psapi

GetModuleFileNameExW

ws2_32

WSAStartup socket setsockopt inet_addr sendto recvfrom ntohs closesocket inet_ntoa htonl ntohl htons

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

dnsapi

DnsFree DnsQuery_W

iphlpapi

SendARP GetIpNetTable GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_db7083e000cb4e1463262ef51075d4f1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

advapi32

shell32

shlwapi

wininet

psapi

ws2_32

version

dnsapi

iphlpapi

generic