2026-10-08_15686d830fecaead0d509c7fba562eac_amadey_coinminer_elex_graphican_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-08_15686d830fecaead0d509c7fba562eac_amadey_coinminer_elex_graphican_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader
Size 764KB
Sample261009-za9skset21
SHA256 552ed4f580926225e80c8637176c0ce5270c843206dc29be13db6c9f72830538
MD5 15686d830fecaead0d509c7fba562eac
SHA1 832a2c8753772e12e2ec28f80ff22bb62969f305
SHA512 feb82d956193567465f24d40992f1bc00506ab5ef07245d488f6928ea42df1195b679e02570246c789ffce8e8f28045f546ccba0eb36f410d2796c3416a23fec
SSDEEP 12288:MnlRtjhPdTJRlXC8UDFc/CRHXy4yQFDhsNAQxheZfOyXb5y2DQyJ+8BEGDPNFZaf:wlRtJdcLDzJQCFZ1XBHc+RBJPIE2NFG0
TLSH
T12FF46B20B686C077D5B211B15E3DE77A807DB9300B2A49DBE3D44F3E29649D12F3663A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-08_15686d830fecaead0d509c7fba562eac_amadey_coinminer_elex_graphican_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

File Explorer

2026-10-08_15686d830fecaead0d509c7fba562eac_amadey_coinminer_elex_graphican_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

.exe 764KB

2026-10-08_15686d830fecaead0d509c7fba562eac_amadey_coinminer_elex_graphican_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

IMPHASH d954426b2b54540301bf2cbdd50f67e4
SHA256 552ed4f580926225e80c8637176c0ce5270c843206dc29be13db6c9f72830538
MD5 15686d830fecaead0d509c7fba562eac
SHA1 832a2c8753772e12e2ec28f80ff22bb62969f305
SHA512 feb82d956193567465f24d40992f1bc00506ab5ef07245d488f6928ea42df1195b679e02570246c789ffce8e8f28045f546ccba0eb36f410d2796c3416a23fec
SSDEEP 12288:MnlRtjhPdTJRlXC8UDFc/CRHXy4yQFDhsNAQxheZfOyXb5y2DQyJ+8BEGDPNFZaf:wlRtJdcLDzJQCFZ1XBHc+RBJPIE2NFG0
TLSH
T12FF46B20B686C077D5B211B15E3DE77A807DB9300B2A49DBE3D44F3E29649D12F3663A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

319976

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WideCharToMultiByte GetLocalTime OutputDebugStringW GetTickCount64 ProcessIdToSessionId GetProcAddress SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetModuleHandleW GetPrivateProfileStringW GlobalLock UnregisterWaitEx QueryDepthSList GlobalUnlock OutputDebugStringA WaitForMultipleObjects WaitForSingleObject SetEvent LoadLibraryA GlobalAlloc GlobalFree ResetEvent FreeLibrary CreateEventW SetEnvironmentVariableW LoadLibraryW ExitProcess Sleep InterlockedPopEntrySList ReleaseSemaphore VirtualProtect GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber GetFileSize CloseHandle CreateFileW ReadFile GetCurrentProcessId GetProcessHeap DeleteCriticalSection DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait CreateTimerQueue WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetConsoleCP ReadConsoleW GetConsoleMode GetFileType DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx HeapFree GetACP GetTempPathW GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind LoadLibraryExW InterlockedFlushSList InterlockedPushEntrySList GetCPInfo LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW EncodePointer GetExitCodeThread GetCurrentThread DuplicateHandle QueryPerformanceFrequency TryEnterCriticalSection InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx GetVersionExW GetModuleHandleA FileTimeToSystemTime GetSystemInfo FileTimeToLocalFileTime GetSystemTime GetModuleFileNameW SetNamedPipeHandleState WaitNamedPipeA CreateNamedPipeA GetCurrentProcess WriteFile DisconnectNamedPipe CreateFileA LocalFree QueryFullProcessImageNameW ConnectNamedPipe FlushFileBuffers TerminateProcess OpenProcess CreateToolhelp32Snapshot FormatMessageW DeleteFileW FindFirstFileW FindNextFileW SetFilePointer SetEndOfFile FindClose Process32NextW Process32FirstW ReadProcessMemory CreateDirectoryW GetFileAttributesW MultiByteToWideChar GetCurrentThreadId GetProcessTimes GetComputerNameExW SetLastError EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection GetTickCount VirtualFree VirtualAlloc GetFileSizeEx GetFileTime K32GetModuleFileNameExW SetFilePointerEx GetStdHandle IsDebuggerPresent

user32

UnhookWinEvent PostMessageW EnumWindows SetWinEventHook SendInput GetAncestor PostThreadMessageW TranslateMessage SetFocus PeekMessageW EmptyClipboard CloseClipboard DispatchMessageW OpenClipboard IsWindow keybd_event GetMessageW FindWindowW GetForegroundWindow ExitWindowsEx UnregisterClassW TranslateAcceleratorW GetLastInputInfo ReleaseDC PostQuitMessage KillTimer GetDlgItem GetClientRect SetWindowLongW SetLayeredWindowAttributes RegisterClassW SetTimer LoadAcceleratorsW LoadStringW GetWindowTextW GetClassInfoW GetClassNameW GetWindowTextA GetClassNameA GetWindowTextLengthW GetWindowThreadProcessId IsClipboardFormatAvailable AddClipboardFormatListener RemoveClipboardFormatListener CloseWindow GetWindowTextLengthA LoadIconW SendDlgItemMessageW IsDialogMessageW GetClipboardData CallWindowProcW GetWindowRect GetScrollInfo AdjustWindowRect GetParent EnableWindow GetDlgCtrlID DefWindowProcW EnumDisplayMonitors CreateWindowExW RegisterClassExW LoadCursorW UpdateWindow BeginPaint EndPaint GetWindowLongW CreateDialogParamW ShowScrollBar GetDC SetWindowPos SendMessageW EndDialog GetSystemMetrics SetWindowTextW ShowWindow

gdi32

GetStockObject TextOutW AngleArc SetBkMode LineTo CreatePen MoveToEx SetTextAlign SelectObject CreateFontW GetTextMetricsW SetTextColor DeleteObject CreateSolidBrush DeleteDC CreateCompatibleDC CreateDIBSection BitBlt ExtTextOutW Rectangle GetTextExtentPoint32W

winspool.drv

FindFirstPrinterChangeNotification EnumJobsW FindClosePrinterChangeNotification FreePrinterNotifyInfo FindNextPrinterChangeNotification ClosePrinter OpenPrinterW EnumPrintersW GetJobW

advapi32

ReportEventW RegQueryValueExW RegSetValueExW GetUserNameW RegCloseKey RegQueryValueExA RegSetValueExA RegOpenKeyExA GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW OpenProcessToken RegisterEventSourceW DeregisterEventSource CryptReleaseContext CryptGetHashParam RegOpenKeyExW CryptDestroyHash CryptHashData CryptCreateHash LookupPrivilegeValueA CryptAcquireContextW AdjustTokenPrivileges OpenServiceW OpenSCManagerW CloseServiceHandle ImpersonateLoggedOnUser RevertToSelf LogonUserW DuplicateToken ConvertSidToStringSidW

shell32

SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoSetProxyBlanket CoInitializeSecurity CoUninitialize CoCreateGuid StringFromGUID2 CoCreateInstance CoInitializeEx CoInitialize

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

shlwapi

PathCanonicalizeW

secur32

GetUserNameExW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

oleacc

WindowFromAccessibleObject AccessibleObjectFromEvent AccessibleObjectFromWindow

netapi32

DsGetDcNameW NetApiBufferFree

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW

Name

.text

Size

559KB

Virtual Size

559KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

142KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-08_15686d830fecaead0d509c7fba562eac_amadey_coinminer_elex_graphican_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

shlwapi

secur32

userenv

oleacc

netapi32

wtsapi32

generic