2026-09-30_2bfc5392e792d3e70f0d381510580772_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_2bfc5392e792d3e70f0d381510580772_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop
Size 10.6MB
Sample260930-pylesaws4k
SHA256 c4b59dd497cfb4fae71546ba0a9be075e89b29dd8ecaa9f3edf819905dd89ad5
MD5 2bfc5392e792d3e70f0d381510580772
SHA1 480f1fd563b66d403c15695d4c72d54c39e70d7d
SHA512 00d5a75be80344f03492303b7c50129a47516c798300c0d99853b7fb254928cab8d70b104ae2afd9497baf6e9a4fb35ea5ebf54aac80f5971c8f3495ace44c6b
SSDEEP 196608:Cd7sqo8pZZv/raokBE31K0zUsdq1/lmVlpOOo1VIXnJpvoCe:NqBpzQBq10EogV7OX1Vk7e
TLSH
T14AB60233B16180A0C659193565722F3D3DF44FA95EA1D8ABFBA4FCE43D324A1A737209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_2bfc5392e792d3e70f0d381510580772_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop

File Explorer

2026-09-30_2bfc5392e792d3e70f0d381510580772_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop

.exe 10.6MB

2026-09-30_2bfc5392e792d3e70f0d381510580772_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop

IMPHASH e1b2140935fa1b81f8058ee5302d2575
SHA256 c4b59dd497cfb4fae71546ba0a9be075e89b29dd8ecaa9f3edf819905dd89ad5
MD5 2bfc5392e792d3e70f0d381510580772
SHA1 480f1fd563b66d403c15695d4c72d54c39e70d7d
SHA512 00d5a75be80344f03492303b7c50129a47516c798300c0d99853b7fb254928cab8d70b104ae2afd9497baf6e9a4fb35ea5ebf54aac80f5971c8f3495ace44c6b
SSDEEP 196608:Cd7sqo8pZZv/raokBE31K0zUsdq1/lmVlpOOo1VIXnJpvoCe:NqBpzQBq10EogV7OX1Vk7e
TLSH
T14AB60233B16180A0C659193565722F3D3DF44FA95EA1D8ABFBA4FCE43D324A1A737209
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10013349

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalFlags GetCurrentThread GetFileTime GetFileSize TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer DuplicateHandle lstrcpynA SetLastError FileTimeToLocalFileTime FileTimeToSystemTime LocalFree InterlockedDecrement InterlockedIncrement SetErrorMode GetProcessVersion GetCPInfo GetOEMCP GetStartupInfoA RtlUnwind RaiseException GetTimeZoneInformation GetSystemTime GetLocalTime TerminateProcess HeapSize GetACP UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr GetStringTypeA GetStringTypeW SetUnhandledExceptionFilter CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr WideCharToMultiByte MultiByteToWideChar GetCurrentProcess GetWindowsDirectoryA GetSystemDirectoryA TerminateThread CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource ReadFile lstrlenW RemoveDirectoryA GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA DeleteFileA CopyFileA CreateDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle SetStdHandle GlobalFindAtomA VirtualQuery GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW LoadLibraryA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep FreeLibrary GetTickCount GlobalFree GetProcAddress LocalAlloc LocalFree ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCommandLineA RaiseException RtlUnwind HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

GetWindowTextA SetWindowTextA GetMenuItemCount GetMenuItemID GetMenuStringA GetMenuState GetTabbedTextExtentA DrawStateA GrayStringA TabbedTextOutA WindowFromDC EnumChildWindows GetWindowDC UnhookWindowsHookEx CallNextHookEx SetWindowsHookExA FrameRect GetPropA MoveWindow CallWindowProcA SetPropA DrawTextA GetCursor LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu UnregisterClassA GetForegroundWindow GetSysColorBrush ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild TrackPopupMenu DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle EnableMenuItem GetWindowTextLengthA CharUpperA BeginPaint EndPaint GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA GetClassLongA CreateWindowExA RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA CheckMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions GetClassNameA GetDesktopWindow LoadStringA GetUserObjectInformationW CharUpperBuffW MessageBoxW GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

gdi32

RestoreDC SaveDC SetWindowOrgEx SetTextColor SetBkMode SetBkColor CreateRectRgnIndirect SetPixel SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn CreatePenIndirect GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBrushIndirect CreateBitmap CreatePen PatBlt CombineRgn CreateRectRgn FillRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt GetPixel CreateCompatibleDC SetPixelV Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps PtVisible RectVisible TextOutA ExtTextOutA Escape ExtSelectClipRgn GetViewportExtEx GetTextMetricsA GetTextColor SelectObject LineTo MoveToEx ExcludeClipRect GetClipBox ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetROP2 SetPolyFillMode

winmm

waveOutGetNumDevs waveOutPrepareHeader waveOutUnprepareHeader waveOutOpen midiOutUnprepareHeader midiStreamOpen waveOutClose midiOutPrepareHeader midiStreamOut midiStreamStop midiOutReset midiStreamClose midiStreamRestart waveOutReset waveOutPause midiStreamProperty waveOutWrite

msimg32

GradientFill

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

RegQueryValueA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegCloseKey RegQueryValueExA

shell32

SHGetSpecialFolderPathA Shell_NotifyIconA ShellExecuteA

ole32

CLSIDFromProgID OleRun CoCreateInstance CLSIDFromString OleUninitialize OleInitialize

oleaut32

LoadTypeLi LHashValOfNameSys RegisterTypeLi SysAllocString VariantClear VariantChangeType VariantCopyInd VariantInit UnRegisterTypeLi

comctl32

ImageList_Destroy ImageList_Create ImageList_Read ImageList_DrawIndirect ord17 ImageList_AddMasked _TrackMouseEvent ImageList_Draw ImageList_SetBkColor ImageList_GetImageCount ImageList_GetImageInfo ImageList_GetIcon ImageList_Duplicate

ws2_32

inet_ntoa WSACleanup closesocket WSAAsyncSelect recvfrom ioctlsocket recv getpeername accept

comdlg32

GetFileTitleA GetOpenFileNameA ChooseColorA GetSaveFileNameA

wtsapi32

WTSSendMessageW

i��ݮ��q��ߗ�� C�<z��?མ��P�Ba��F�9��z��%1��<��a<n��Y�HhõteH�g9ӝV~��uЩu~�K�/�T��MZGVvsP��}&u�>�-��N+��\!q�gܗ<�VQg��F)��g�� y�jQ^]:�>��t�pj�eg�hyʕ˴�X�Swz��i�Y�?��|��E~ Ϫ�w%��G�c�DoqK�J2v��!�Ղt�@��HAZN��tK#�UM��.��48��Q��]�禊�>J��I<�b�R�tI}��j�0��x�T�N{�y-%ٟ��k�k7]!��-2�ic �o� ��u�E'��W#��d�^�cG��=!u)��yL�v�Ze�.��>��15L�X,G�1�3qU�]>�S��@2��K4<�� S�6�z��+f?qL6_��Lqm�jAZK�+��3%��B�;�oKbcv��G��⤞��?tj�Rl�E+��>�3Q=d�L�ǁ6��»fUe�ʷxҎ��^T��M[��U�7��jйqX��c��k`�ҏ!� �TF�X��jKd��V��_��m\2�:��4�I��(��nPZ0��ޗ<*�>1ȸd�?%&�<��i�V{��V�q��@'ٞ:b�}"DRcȔ�U�j��z��@@�(>L��oXj�xᱮ�9_�Y݈[;�D��Ô��լG5+�s �1?�j5P�e��)�Y<e�V ��`n�kڐG%��N:��>��X�F-/x�Q6��O؄�<X4�I�]_u|��RN��~V��Hjf]1��n|@~_x��X�"B�NxjO�'��̢�CY�+��_��qJ7�O��~��^ޔ#��.�8(��%��^��/6�pì��]��@�c��[.?{�![1�sL��O�-�K��?�0z��\�,��c��؃�)�ʡ�o˨!��f��1�R��&��ߌ��U�!��g��B�A��Mr��~1)��9gB�X;��Y��V��d�`�^��=?") `ĺ�r��F�C��P�x��-��u1�U��E��|M>ܙ��v��ʜ0�3'r]�� R;��r�Ot�S�v�?��K�*tH�k_^��!��F�z=��d�ZuO��g?+��(�@�"��M�� AA�e�o��Z�ziT�c"(�ȸ�o��.?ga��o�̀lbP�_�`4��^bʀv��j��d�}A��K�I�8��hȼ��{J�c.0y�4v1�,-j�,��Ï�"��]],IMN#p^"G��M��2˨Ǆ��.�K,�ۼ�+z��K͈�P�"ӥ<"yo��;�䅄X��-4��tK��Hg��i�$=��x\*y�u��a1a%�+Ŋ��lO��V��c�ԭL�,Y�C��}="��T�\��L?<�_�xm3<P5�1. k�rbt�_�ַvD|l��H%�ρ)�D��N�<�u�ي��8�Cq��]V�ȴ��>ӄy�իUO�/�M[�9��>��[6({��d��L�!�i�X޳Q�D��mo�@["S}~��&�&�r��,�n��_#��H��Y""�s��c�%`zTj��bU�T�\��#��^�y��j��#�?B��t��7�b5�x�^`�J�2�+3vh-f�i��5�c�~_ٻ��O�=�=~r��*��q��o+��s�V��K^�zwd��ֳ,XnG��M��>*w(��H2$mZ��XD��.�0��}�UW/�H��y慣 I�K�cӐ��\Vj��Ą��Ȟ�b�^j�H�+�v��6�p9ϙ�ɥ$�5��^�"�c��§�)��qW�ުe��bB�->�uw�Ի��v_Gzu��,��W|ё��ET4��(/<;V�t�gw�;t�N��G��B�΃�w뾉�l��<e�A�cC��Ȣ��E4�ϫ8y肽��G,��4'�mߴXl��3� A��,��"/K�)��]ˬّ� )�L��6�=��[I��=�Cm��[49�68K�+��lq�Ϊ�[��^��i�{�ً��KoD�{�j:.��j��)�� uO��]�n��8ƿ��U�'�8)q�1�B�=rbпh��u��h��뢩��O�`��p2)�ָ��7�� ΅v��Vr)��3�].�� Y�4�Z.48ݴs��J�(eJ��ձ��0o3Yﰹ�� J�o�c΢5�k_�r�O�x��Nc�!�=�G;�6�b:��>�c$0��IW��D��팤�11��w�Ń؁7�Y<g�f�~l;o噚i��L��b�y=%x*�l8��%Q�A�)�*[�4�.x�G%��#;(��Ԣ��k<�QcZ *?P��, ��>�E~�JJަ��B��l�j$�'�O;p1&P|�� {�@Vq#G��3(&O��_�8��)��@�z��0SV��eLB8@�}�w� c��E�Xz��&��#H��K)*Gl3 �*T,�E��q�Z��컥!�Î��Pz�j݃/AV�W��'ƀ��I�S�[t4��|�t�ߙ�v� g�#D.��.�F�V��0d�RUyh��8�f71�U^szX^;!ZH��hߙ|�ԁg��X��h4��﷒�j϶��F[(�E�#/��ا��߽Ţ��iQ�\$ȼn�@b�� @�f�Gc^2��gUgnIYm�=��ў�>{3)�8�v��j'� d h rT��"8�J��6`��Y��Z!�:�mmS��8Ew�p�\aͯ��܃� S�P��̣��a�i��-h�7� P ��B갴�N$&.b>`*��ӭ�Ș��H��M��~%DF�=��~�7R=��;>C�� b/ָ��4�x>׌��)�_�e�֮�e�ד'<iY6��

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

300KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ZoqAzh0

Size

6.6MB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

ZoqAzh1

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

188KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_2bfc5392e792d3e70f0d381510580772_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop

kernel32

user32

gdi32

winmm

msimg32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

wtsapi32

generic