2026-10-08_36bd3cbfeaf565aed923e12785b86760_amadey_coinminer_elex_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-08_36bd3cbfeaf565aed923e12785b86760_amadey_coinminer_elex_luca-stealer_njrat_remcos_smoke-loader
Size 610KB
Sample261009-vt4y8ada92
SHA256 4c8c51c5f24360c3403cdee8fa067b0800634abfe9c4180f878e85e7d50bd26f
MD5 36bd3cbfeaf565aed923e12785b86760
SHA1 d796d18d2ae4270049fd6c7f42f032d6c187b48e
SHA512 f94fe241039b5c45e457838809429629d34d32edc32d42d29ba2a798d9d3e3189b094cf84c44ffb081a7a022bdf394fe3bc8bb1ff07db943fe71ffea4b81b9a9
SSDEEP 12288:/8EQJsjj5Jj/dDrncKKMFkC3TkSGU517xnpCuTPsNr6tSR:/8DYj5BdHncK+0B5TpxTPsNOe
TLSH
T1B8D43A21645AC23AE6B551F0067D9E5A906EBD2C5F700ACB97C00E7B5470EE36B36E33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-08_36bd3cbfeaf565aed923e12785b86760_amadey_coinminer_elex_luca-stealer_njrat_remcos_smoke-loader

.exe 610KB

2026-10-08_36bd3cbfeaf565aed923e12785b86760_amadey_coinminer_elex_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 99367c4430868c0cf595e7b49d97005f
SHA256 4c8c51c5f24360c3403cdee8fa067b0800634abfe9c4180f878e85e7d50bd26f
MD5 36bd3cbfeaf565aed923e12785b86760
SHA1 d796d18d2ae4270049fd6c7f42f032d6c187b48e
SHA512 f94fe241039b5c45e457838809429629d34d32edc32d42d29ba2a798d9d3e3189b094cf84c44ffb081a7a022bdf394fe3bc8bb1ff07db943fe71ffea4b81b9a9
SSDEEP 12288:/8EQJsjj5Jj/dDrncKKMFkC3TkSGU517xnpCuTPsNr6tSR:/8DYj5BdHncK+0B5TpxTPsNOe
TLSH
T1B8D43A21645AC23AE6B551F0067D9E5A906EBD2C5F700ACB97C00E7B5470EE36B36E33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

be:94:22:01:e5:55:1d:91:08:3e:6a:e3:f1:d4:37:12:c0:ed:1c:34:09:ad:a6:e0:e5:82:86:12:29:34:9e:9b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=913101150729060470,CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c0ce6b5a6e4b89ce696b0e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e4b88ae6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 10, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

9f:a2:41:06:81:e9:41:20:e2:8c:cf:54:c0:98:60:50:68:a9:35:3c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Jul 10, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

0d:7e:f8:80:11:79:bf:12:a7:46:6f:7d:a5:b3:27:7a

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 28, 2023 - Jul 7, 2026

Minor OS version

Major OS version

Entry point

313270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\zhanlue\rcimage\bin\Win32\Release\pdb\2345PicHelper.pdb

kernel32

GetFullPathNameW lstrlenW GetFileAttributesW SetFileAttributesW DeleteFileW MoveFileExW GetTempFileNameW MoveFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection DecodePointer RaiseException InitializeCriticalSectionAndSpinCount GetTickCount OpenProcess GetCurrentProcess GetCurrentProcessId TerminateProcess CreateDirectoryW Sleep MultiByteToWideChar FileTimeToSystemTime LocalFree GlobalAlloc GlobalFree SystemTimeToFileTime IsBadStringPtrW GetFileSize CloseHandle SetEndOfFile SetFilePointer WriteFile ReadFile FindClose FindNextFileW GetLastError CreateFileW LoadLibraryExW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW SetErrorMode LocalAlloc WaitForSingleObject GetModuleFileNameW GetVersionExW GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW OutputDebugStringW RtlUnwind SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP GetStringTypeW HeapFree HeapAlloc GetFileType LCMapStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap HeapSize HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW LockResource LoadResource FindResourceW lstrcmpiW GetEnvironmentVariableW CreateMutexW ReleaseMutex InterlockedExchangeAdd

advapi32

RegQueryValueExW RegCloseKey CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus BuildExplicitAccessWithNameW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW RegCreateKeyW RegSetValueExW GetUserNameW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenCurrentUser

shell32

SHChangeNotify SHGetPathFromIDListW SHGetSpecialFolderLocation

ole32

CoTaskMemFree CoInitializeEx CoCreateInstance CoSetProxyBlanket CoUninitialize CoInitializeSecurity

oleaut32

VariantChangeType VariantClear VariantInit SysAllocString

imm32

ImmDisableIME

shlwapi

SHDeleteKeyW

wtsapi32

WTSQuerySessionInformationW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-08_36bd3cbfeaf565aed923e12785b86760_amadey_coinminer_elex_luca-stealer_njrat_remcos_smoke-loader

kernel32

advapi32

shell32

ole32

oleaut32

imm32

shlwapi

wtsapi32

generic