2026-10-16_1bd40e06f4114849c510f4282332624e_amadey_coinminer_elex_floxif_glassworm_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_1bd40e06f4114849c510f4282332624e_amadey_coinminer_elex_floxif_glassworm_rhadamanthys_smoke-loader_stop
Size 47.0MB
Sample261017-2gfjesev2x
SHA256 905740627020a443705c97386ac4507b0c977529ce59777efc3db2355817ec30
MD5 1bd40e06f4114849c510f4282332624e
SHA1 7830f141ed80a712b6284f4c06b5e4ea58c8245e
SHA512 c3c1c555dc02f04677a0d515cc5f84a367b6cfbd7f5b4903ecdc6fc82f3bdba187f5774ef83b8b6db2f70ac86a70319b02aecced0e8a71de7e148a79c971a417
SSDEEP 393216:eWJf/xZjinAPl+x4ukrGDGwiC7TCTtaYgXnAM:eGfHji2/HCKp4QM
TLSH
T114B78CE4FB8546B1EC5901B9412A7B3E4331E7090F16DBC7E590FA01AEA39F2783D586
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_1bd40e06f4114849c510f4282332624e_amadey_coinminer_elex_floxif_glassworm_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-16_1bd40e06f4114849c510f4282332624e_amadey_coinminer_elex_floxif_glassworm_rhadamanthys_smoke-loader_stop

.exe 47.0MB

2026-10-16_1bd40e06f4114849c510f4282332624e_amadey_coinminer_elex_floxif_glassworm_rhadamanthys_smoke-loader_stop

IMPHASH e11ef64e58d9fe6579071831b7a09a3c
SHA256 905740627020a443705c97386ac4507b0c977529ce59777efc3db2355817ec30
MD5 1bd40e06f4114849c510f4282332624e
SHA1 7830f141ed80a712b6284f4c06b5e4ea58c8245e
SHA512 c3c1c555dc02f04677a0d515cc5f84a367b6cfbd7f5b4903ecdc6fc82f3bdba187f5774ef83b8b6db2f70ac86a70319b02aecced0e8a71de7e148a79c971a417
SSDEEP 393216:eWJf/xZjinAPl+x4ukrGDGwiC7TCTtaYgXnAM:eGfHji2/HCKp4QM
TLSH
T114B78CE4FB8546B1EC5901B9412A7B3E4331E7090F16DBC7E590FA01AEA39F2783D586
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11689952

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SuspendThread ResumeThread GetCommandLineA InterlockedExchange WaitForSingleObject InterlockedDecrement InterlockedIncrement CreateFileA SetFilePointer ReadFile WriteFile SetEndOfFile MoveFileA FindClose FindFirstFileA CreateEventA PulseEvent HeapFree GetProcessHeap HeapAlloc GetFileSize GetFullPathNameA SetEvent GetThreadPriority GetProcessAffinityMask ResetEvent GetExitCodeThread InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection FindNextFileA SetLastError RemoveDirectoryA DeleteFileA SetFileAttributesW CreateFileW SetFileAttributesA SetFilePointerEx GetFileAttributesExW GetFileAttributesExA InterlockedCompareExchange InterlockedExchangeAdd InitializeCriticalSectionAndSpinCount TryEnterCriticalSection CreateSemaphoreA ReleaseSemaphore GetDiskFreeSpaceExW GetLogicalDriveStringsW MulDiv DuplicateHandle CreateProcessA GetExitCodeProcess LocalAlloc ExitProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess FreeLibrary GetLocalTime SystemTimeToFileTime SystemTimeToTzSpecificLocalTime LocalFileTimeToFileTime GetTickCount LoadLibraryA GetSystemInfo GetProcAddress GetFileAttributesW GetLastError SetCurrentDirectoryW CloseHandle GetVersionExA ReleaseMutex GlobalMemoryStatus CreateDirectoryA QueryPerformanceCounter QueryPerformanceFrequency WaitForMultipleObjects GetEnvironmentVariableA lstrcpyA lstrcatA GetDiskFreeSpaceExA GetFileSizeEx SetEnvironmentVariableA CompareStringW CompareStringA GetDriveTypeA GetLocaleInfoW WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle GetStringTypeW GetStringTypeA SetThreadAffinityMask GetCurrentThreadId SetThreadPriority Sleep MultiByteToWideChar CreateMutexA GetCurrentProcess GetModuleFileNameW SetErrorMode DeleteFileW FileTimeToLocalFileTime IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetTimeZoneInformation GetCurrentDirectoryA GetFullPathNameW VirtualQuery GetCurrentProcessId GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStdHandle HeapReAlloc VirtualAlloc VirtualFree HeapCreate HeapDestroy IsValidCodePage GetOEMCP FileTimeToSystemTime GetACP GetModuleHandleA WideCharToMultiByte SetPriorityClass CreateDirectoryW SizeofResource HeapSize GetCurrentThread TlsFree TlsSetValue TlsAlloc TlsGetValue SetThreadExecutionState LoadResource GetLocaleInfoA GetFileAttributesA FindResourceA GetConsoleMode GetConsoleCP GetCPInfo LCMapStringW LCMapStringA RaiseException GetSystemTimeAsFileTime GetDriveTypeW RtlUnwind CreateThread ExitThread SleepEx SetWaitableTimer CreateWaitableTimerA FindFirstFileW FindNextFileW GetStartupInfoA

user32

SetFocus GetWindowRect CreateWindowExA GetDoubleClickTime SystemParametersInfoA MonitorFromRect GetClientRect GetCursorPos TranslateAcceleratorA LoadIconA GetSystemMetrics ReleaseDC RegisterWindowMessageA MsgWaitForMultipleObjects GetQueueStatus PostThreadMessageA MessageBoxA EnumDisplaySettingsA GetDC ShowCursor DefWindowProcA PostMessageA GetActiveWindow MessageBoxW ScreenToClient GetWindowThreadProcessId AdjustWindowRectEx AttachThreadInput SetCursor SetForegroundWindow DrawMenuBar EndPaint GetForegroundWindow GetMonitorInfoA ShowWindow GetWindowLongA BeginPaint UnregisterClassA SetWindowPos IsIconic RedrawWindow PostQuitMessage RegisterClassExA CallWindowProcA RegisterDeviceNotificationA wsprintfA DispatchMessageA GetMessageA TranslateMessage InvalidateRect UpdateWindow PeekMessageA SetWindowLongA

gdi32

GetStockObject GetDeviceCaps

advapi32

CryptAcquireContextA RegQueryValueExA RegEnumKeyExA CryptImportKey RegOpenKeyExW RegCloseKey RegQueryValueExW GetUserNameA CryptReleaseContext CryptGenRandom CryptDestroyHash CryptGetHashParam CryptHashData CryptCreateHash CryptDestroyKey CryptEncrypt RegOpenKeyExA

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc SHGetFolderPathA ShellExecuteA SHGetFileInfoW

ole32

CoCreateGuid CoTaskMemFree CoTaskMemAlloc CoFreeUnusedLibraries CoInitialize CoUninitialize CoInitializeEx CoCreateInstance

d3dx9_30

D3DXGetVertexShaderProfile D3DXGetShaderConstantTable D3DXCreateCubeTexture D3DXLoadSurfaceFromMemory D3DXGetPixelShaderProfile D3DXCreateVolumeTexture D3DXCreateTexture D3DXLoadVolumeFromMemory D3DXMatrixMultiply D3DXCreateVolumeTextureFromFileInMemoryEx D3DXCreateCubeTextureFromFileInMemoryEx D3DXCreateTextureFromFileInMemoryEx D3DXGetImageInfoFromFileInMemory D3DXVec3Transform D3DXAssembleShader D3DXQuaternionSlerp D3DXVec4Transform D3DXCompileShader D3DXCheckTextureRequirements D3DXQuaternionInverse D3DXMatrixTranspose D3DXMatrixDeterminant D3DXMatrixInverse D3DXVec3TransformNormal D3DXVec3Normalize D3DXQuaternionNormalize D3DXQuaternionMultiply

iphlpapi

GetAdaptersInfo GetIpAddrTable GetBestRoute SetIpForwardEntry GetIpForwardTable GetNetworkParams

d3d9

Direct3DCreate9

ddraw

DirectDrawCreate

dsound

ord12 ord2 ord11

winmm

timeKillEvent timeSetEvent timeGetTime timeEndPeriod timeBeginPeriod

imm32

ImmGetContext ImmAssociateContext

dinput8

DirectInput8Create

wininet

HttpAddRequestHeadersA InternetCrackUrlA InternetSetStatusCallback HttpQueryInfoA HttpOpenRequestA HttpSendRequestA InternetOpenA InternetConnectA InternetCloseHandle InternetReadFileExA

oleaut32

SysStringLen SysAllocString SysFreeString

rpcrt4

UuidToStringA RpcStringFreeA

psapi

GetProcessMemoryInfo

Name

.text

Size

11.1MB

Virtual Size

11.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6.5MB

Virtual Size

6.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Stext

Size

6.2MB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Sitext

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Srdata

Size

360KB

Virtual Size

360KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Sdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Sidata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.securom

Size

18.3MB

Virtual Size

18.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_1bd40e06f4114849c510f4282332624e_amadey_coinminer_elex_floxif_glassworm_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

d3dx9_30

iphlpapi

d3d9

ddraw

dsound

winmm

imm32

dinput8

wininet

oleaut32

rpcrt4

psapi

generic