2026-10-14_9d568df461302b16b82d7798b8a1f72f_coinminer_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-14_9d568df461302b16b82d7798b8a1f72f_coinminer_elex_rhadamanthys_smoke-loader_stop
Size 920KB
Sample261014-s8mmdafs8t
SHA256 2625828c1c947d7c9d2d4fac31279d4be20bd540b263c4c8cd7827ffd0b2e88e
MD5 9d568df461302b16b82d7798b8a1f72f
SHA1 be3f01ebef2b3313b28969a06feaffccb0ad8d5a
SHA512 7a7acfe115546e01c3b4875ad4c076550877b528289b12e4772a273cda1c943674c45356f62cb6c02e57e06f2fe4f266c42ea32f29a92de028d68252d79217ae
SSDEEP 12288:cA+8XMKytDId2Vnqwm978bqHKmnA8UOBg8Q2r2hcR5u6vj37decrh27DrkC5W9DN:X9N7MtCrHKonUfU5uyj37xh27pw9DN
TLSH
T15815132331D0C0F2D8A604B64937C66567B3FD71DA378A8B7FD6174A6F610668B2A3C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-14_9d568df461302b16b82d7798b8a1f72f_coinminer_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-14_9d568df461302b16b82d7798b8a1f72f_coinminer_elex_rhadamanthys_smoke-loader_stop

.exe 920KB

2026-10-14_9d568df461302b16b82d7798b8a1f72f_coinminer_elex_rhadamanthys_smoke-loader_stop

IMPHASH 3633c4654a13ee20f83d0b2f70ead08a
SHA256 2625828c1c947d7c9d2d4fac31279d4be20bd540b263c4c8cd7827ffd0b2e88e
MD5 9d568df461302b16b82d7798b8a1f72f
SHA1 be3f01ebef2b3313b28969a06feaffccb0ad8d5a
SHA512 7a7acfe115546e01c3b4875ad4c076550877b528289b12e4772a273cda1c943674c45356f62cb6c02e57e06f2fe4f266c42ea32f29a92de028d68252d79217ae
SSDEEP 12288:cA+8XMKytDId2Vnqwm978bqHKmnA8UOBg8Q2r2hcR5u6vj37decrh27DrkC5W9DN:X9N7MtCrHKonUfU5uyj37xh27pw9DN
TLSH
T15815132331D0C0F2D8A604B64937C66567B3FD71DA378A8B7FD6174A6F610668B2A3C1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51566

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\landun\workspace\p-ad0484fbdfe349d18f6d70b4084a70ba\src\product\win32\dbginfo\menuhelper.pdb

kernel32

CreateFileW GetFileSize FlushFileBuffers LoadResource WideCharToMultiByte MultiByteToWideChar GetLastError LockResource RaiseException FindResourceExW FindResourceW SizeofResource GetModuleFileNameW GetFileAttributesW CreateFileA LoadLibraryW EnterCriticalSection GetProcAddress LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetPrivateProfileStringW FreeLibrary GetVersionExW GetSystemDirectoryW GetModuleHandleW ReadFile WriteFile SetFilePointer CloseHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle LoadLibraryA GetConsoleMode InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale GetVersionExA HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime GetStartupInfoW GetCPInfo InterlockedIncrement InterlockedDecrement GetOEMCP IsValidCodePage GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId LCMapStringA LCMapStringW HeapCreate VirtualFree VirtualAlloc Sleep ExitProcess GetStdHandle GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA RtlUnwind FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetStringTypeA GetStringTypeW GetConsoleCP

advapi32

RegOpenKeyExW RegCloseKey RegOpenKeyW RegQueryValueExW

ole32

CLSIDFromString

shlwapi

PathFileExistsW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

user32

UnregisterClassA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-14_9d568df461302b16b82d7798b8a1f72f_coinminer_elex_rhadamanthys_smoke-loader_stop

kernel32

advapi32

ole32

shlwapi

version

user32

generic