2026-09-30_52a11991572321e8d959c5a92ac39b3d_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_52a11991572321e8d959c5a92ac39b3d_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop
Size 10.6MB
Sample260930-nj29batcjf
SHA256 e852bb7b9c8e99c716fe61676f163f9579a55f05f9977fd153d97bc50227b8f9
MD5 52a11991572321e8d959c5a92ac39b3d
SHA1 db11a3992b97a7eed256a3a88c6cd82379e784a7
SHA512 daad753e3f8aee94fe5f00698e3e3e04302150be1135522f6a3ecd9fe1049e4ff31523622e692699832424b77e3c89b1e6619e15c7b8f4986d0250a810d9ab10
SSDEEP 196608:Cd7sqg8pZZv/raokBE31K0zUsdq1/lmVlpOOo1VIXnJpvoCo:NqZpzQBq10EogV7OX1Vk7o
TLSH
T123B60233B16180A0C659193565722F3D3DF44FA95EA1D8ABFBA4FCE43D324A1A737209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_52a11991572321e8d959c5a92ac39b3d_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop

File Explorer

2026-09-30_52a11991572321e8d959c5a92ac39b3d_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop

.exe 10.6MB

2026-09-30_52a11991572321e8d959c5a92ac39b3d_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop

IMPHASH e1b2140935fa1b81f8058ee5302d2575
SHA256 e852bb7b9c8e99c716fe61676f163f9579a55f05f9977fd153d97bc50227b8f9
MD5 52a11991572321e8d959c5a92ac39b3d
SHA1 db11a3992b97a7eed256a3a88c6cd82379e784a7
SHA512 daad753e3f8aee94fe5f00698e3e3e04302150be1135522f6a3ecd9fe1049e4ff31523622e692699832424b77e3c89b1e6619e15c7b8f4986d0250a810d9ab10
SSDEEP 196608:Cd7sqg8pZZv/raokBE31K0zUsdq1/lmVlpOOo1VIXnJpvoCo:NqZpzQBq10EogV7OX1Vk7o
TLSH
T123B60233B16180A0C659193565722F3D3DF44FA95EA1D8ABFBA4FCE43D324A1A737209
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10013349

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalFlags GetCurrentThread GetFileTime GetFileSize TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer DuplicateHandle lstrcpynA SetLastError FileTimeToLocalFileTime FileTimeToSystemTime LocalFree InterlockedDecrement InterlockedIncrement SetErrorMode GetProcessVersion GetCPInfo GetOEMCP GetStartupInfoA RtlUnwind RaiseException GetTimeZoneInformation GetSystemTime GetLocalTime TerminateProcess HeapSize GetACP UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr GetStringTypeA GetStringTypeW SetUnhandledExceptionFilter CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr WideCharToMultiByte MultiByteToWideChar GetCurrentProcess GetWindowsDirectoryA GetSystemDirectoryA TerminateThread CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource ReadFile lstrlenW RemoveDirectoryA GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA DeleteFileA CopyFileA CreateDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle SetStdHandle GlobalFindAtomA VirtualQuery GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW LoadLibraryA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep FreeLibrary GetTickCount GlobalFree GetProcAddress LocalAlloc LocalFree ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCommandLineA RaiseException RtlUnwind HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

GetWindowTextA SetWindowTextA GetMenuItemCount GetMenuItemID GetMenuStringA GetMenuState GetTabbedTextExtentA DrawStateA GrayStringA TabbedTextOutA WindowFromDC EnumChildWindows GetWindowDC UnhookWindowsHookEx CallNextHookEx SetWindowsHookExA FrameRect GetPropA MoveWindow CallWindowProcA SetPropA DrawTextA GetCursor LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu UnregisterClassA GetForegroundWindow GetSysColorBrush ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild TrackPopupMenu DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle EnableMenuItem GetWindowTextLengthA CharUpperA BeginPaint EndPaint GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA GetClassLongA CreateWindowExA RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA CheckMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions GetClassNameA GetDesktopWindow LoadStringA GetUserObjectInformationW CharUpperBuffW MessageBoxW GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

gdi32

RestoreDC SaveDC SetWindowOrgEx SetTextColor SetBkMode SetBkColor CreateRectRgnIndirect SetPixel SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn CreatePenIndirect GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBrushIndirect CreateBitmap CreatePen PatBlt CombineRgn CreateRectRgn FillRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt GetPixel CreateCompatibleDC SetPixelV Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps PtVisible RectVisible TextOutA ExtTextOutA Escape ExtSelectClipRgn GetViewportExtEx GetTextMetricsA GetTextColor SelectObject LineTo MoveToEx ExcludeClipRect GetClipBox ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetROP2 SetPolyFillMode

winmm

waveOutGetNumDevs waveOutPrepareHeader waveOutUnprepareHeader waveOutOpen midiOutUnprepareHeader midiStreamOpen waveOutClose midiOutPrepareHeader midiStreamOut midiStreamStop midiOutReset midiStreamClose midiStreamRestart waveOutReset waveOutPause midiStreamProperty waveOutWrite

msimg32

GradientFill

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

RegQueryValueA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegCloseKey RegQueryValueExA

shell32

SHGetSpecialFolderPathA Shell_NotifyIconA ShellExecuteA

ole32

CLSIDFromProgID OleRun CoCreateInstance CLSIDFromString OleUninitialize OleInitialize

oleaut32

LoadTypeLi LHashValOfNameSys RegisterTypeLi SysAllocString VariantClear VariantChangeType VariantCopyInd VariantInit UnRegisterTypeLi

comctl32

ImageList_Destroy ImageList_Create ImageList_Read ImageList_DrawIndirect ord17 ImageList_AddMasked _TrackMouseEvent ImageList_Draw ImageList_SetBkColor ImageList_GetImageCount ImageList_GetImageInfo ImageList_GetIcon ImageList_Duplicate

ws2_32

inet_ntoa WSACleanup closesocket WSAAsyncSelect recvfrom ioctlsocket recv getpeername accept

comdlg32

GetFileTitleA GetOpenFileNameA ChooseColorA GetSaveFileNameA

wtsapi32

WTSSendMessageW

i��ݮ��q��ߗ�� C�<z��?མ��P�Ba��F�9��z��%1��<��a<n��Y�HhõteH�g9ӝV~��uЩu~�K�/�T��MZGVvsP��}&u�>�-��N+��\!q�gܗ<�VQg��F)��g�� y�jQ^]:�>��t�pj�eg�hyʕ˴�X�Swz��i�Y�?��|��E~ Ϫ�w%��G�c�DoqK�J2v��!�Ղt�@��HAZN��tK#�UM��.��48��Q��]�禊�>J��I<�b�R�tI}��j�0��x�T�N{�y-%ٟ��k�k7]!��-2�ic �o� ��u�E'��W#��d�^�cG��=!u)��yL�v�Ze�.��>��15L�X,G�1�3qU�]>�S��@2��K4<�� S�6�z��+f?qL6_��Lqm�jAZK�+��3%��B�;�oKbcv��G��⤞��?tj�Rl�E+��>�3Q=d�L�ǁ6��»fUe�ʷxҎ��^T��M[��U�7��jйqX��c��k`�ҏ!� �TF�X��jKd��V��_��m\2�:��4�I��(��nPZ0��ޗ<*�>1ȸd�?%&�<��i�V{��V�q��@'ٞ:b�}"DRcȔ�U�j��z��@@�(>L��oXj�xᱮ�9_�Y݈[;�D��Ô��լG5+�s �1?�j5P�e��)�Y<e�V ��`n�kڐG%��N:��>��X�F-/x�Q6��O؄�<X4�I�]_u|��RN��~V��Hjf]1��n|@~_x��X�"B�NxjO�'��̢�CY�+��_��qJ7�O��~��^ޔ#��.�8(��%��^��/6�pì��]��@�c��[.?{�![1�sL��O�-�K��?�0z��\�,��c��؃�)�ʡ�o˨!��f��1�R��&��ߌ��U�!��g��B�A��Mr��~1)��9gB�X;��Y��V��d�`�^��=?") `ĺ�r��F�C��P�x��-��u1�U��E��|M>ܙ��v��ʜ0�3'r]�� R;��r�Ot�S�v�?��K�*tH�k_^��!��F�z=��d�ZuO��g?+��(�@�"��M�� AA�e�o��Z�ziT�c"(�ȸ�o��.?ga��o�̀lbP�_�`4��^bʀv��j��d�}A��K�I�8��hȼ��{J�c.0y�4v1�,-j�,��Ï�"��]],IMN#p^"G��M��2˨Ǆ��.�K,�ۼ�+z��K͈�P�"ӥ<"yo��;�䅄X��-4��tK��Hg��i�$=��x\*y�u��a1a%�+Ŋ��lO��V��c�ԭL�,Y�C��}="��T�\��L?<�_�xm3<P5�1. k�rbt�_�ַvD|l��H%�ρ)�D��N�<�u�ي��8�Cq��]V�ȴ��>ӄy�իUO�/�M[�9��>��[6({��d��L�!�i�X޳Q�D��mo�@["S}~��&�&�r��,�n��_#��H��Y""�s��c�%`zTj��bU�T�\��#��^�y��j��#�?B��t��7�b5�x�^`�J�2�+3vh-f�i��5�c�~_ٻ��O�=�=~r��*��q��o+��s�V��K^�zwd��ֳ,XnG��M��>*w(��H2$mZ��XD��.�0��}�UW/�H��y慣 I�K�cӐ��\Vj��Ą��Ȟ�b�^j�H�+�v��6�p9ϙ�ɥ$�5��^�"�c��§�)��qW�ުe��bB�->�uw�Ի��v_Gzu��,��W|ё��ET4��(/<;V�t�gw�;t�N��G��B�΃�w뾉�l��<e�A�cC��Ȣ��E4�ϫ8y肽��G,��4'�mߴXl��3� A��,��"/K�)��]ˬّ� )�L��6�=��[I��=�Cm��[49�68K�+��lq�Ϊ�[��^��i�{�ً��KoD�{�j:.��j��)�� uO��]�n��8ƿ��U�'�8)q�1�B�=rbпh��u��h��뢩��O�`��p2)�ָ��7�� ΅v��Vr)��3�].�� Y�4�Z.48ݴs��J�(eJ��ձ��0o3Yﰹ�� J�o�c΢5�k_�r�O�x��Nc�!�=�G;�6�b:��>�c$0��IW��D��팤�11��w�Ń؁7�Y<g�f�~l;o噚i��L��b�y=%x*�l8��%Q�A�)�*[�4�.x�G%��#;(��Ԣ��k<�QcZ *?P��, ��>�E~�JJަ��B��l�j$�'�O;p1&P|�� {�@Vq#G��3(&O��_�8��)��@�z��0SV��eLB8@�}�w� c��E�Xz��&��#H��K)*Gl3 �*T,�E��q�Z��컥!�Î��Pz�j݃/AV�W��'ƀ��I�S�[t4��|�t�ߙ�v� g�#D.��.�F�V��0d�RUyh��8�f71�U^szX^;!ZH��hߙ|�ԁg��X��h4��﷒�j϶��F[(�E�#/��ا��߽Ţ��iQ�\$ȼn�@b�� @�f�Gc^2��gUgnIYm�=��ў�>{3)�8�v��j'� d h rT��"8�J��6`��Y��Z!�:�mmS��8Ew�p�\aͯ��܃� S�P��̣��a�i��-h�7� P ��B갴�N$&.b>`*��ӭ�Ș��H��M��~%DF�=��~�7R=��;>C�� b/ָ��4�x>׌��)�_�e�֮�e�ד'<iY6��

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

300KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ZoqAzh0

Size

6.6MB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

ZoqAzh1

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

188KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_52a11991572321e8d959c5a92ac39b3d_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop

kernel32

user32

gdi32

winmm

msimg32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

wtsapi32

generic