2026-10-30_d904d1eef08503e40f022308fb9a5660_amadey_coinminer_elex_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_d904d1eef08503e40f022308fb9a5660_amadey_coinminer_elex_smoke-loader_stop
Size 7.7MB
Sample261030-srqmpseh55
SHA256 c9c4bc9c5362c44f377df795291cfcc57c4b5101519fa88fff5e57069183968f
MD5 d904d1eef08503e40f022308fb9a5660
SHA1 a6e49d5700604134c299fadadea9b62e3e76529e
SHA512 4faa5be18f34ff3e2b863f9ada3958a34aa99c36f18cd562b90bfc9eedf2ebd5df16fc2d7818db7cbaa7f28b959faefec49f858fd009901f25a82a50e7913a5c
SSDEEP 98304:0iyjYYYj8sk2jYqobZwO+o9O5a/I4dpzfRlFLael9P7UpFK5XaR09TwV:z8topO+o9O8/Xdpzf3FLaelKn6Tu
TLSH
T10A86AE42F2A3D0B1C1593578709E723FED3672544B2946D3FBE42914CBE1AE05AF63A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-30_d904d1eef08503e40f022308fb9a5660_amadey_coinminer_elex_smoke-loader_stop

.exe 7.7MB

2026-10-30_d904d1eef08503e40f022308fb9a5660_amadey_coinminer_elex_smoke-loader_stop

IMPHASH d2bad50735bf2d3989d63188c71e34ed
SHA256 c9c4bc9c5362c44f377df795291cfcc57c4b5101519fa88fff5e57069183968f
MD5 d904d1eef08503e40f022308fb9a5660
SHA1 a6e49d5700604134c299fadadea9b62e3e76529e
SHA512 4faa5be18f34ff3e2b863f9ada3958a34aa99c36f18cd562b90bfc9eedf2ebd5df16fc2d7818db7cbaa7f28b959faefec49f858fd009901f25a82a50e7913a5c
SSDEEP 98304:0iyjYYYj8sk2jYqobZwO+o9O5a/I4dpzfRlFLael9P7UpFK5XaR09TwV:z8topO+o9O8/Xdpzf3FLaelKn6Tu
TLSH
T10A86AE42F2A3D0B1C1593578709E723FED3672544B2946D3FBE42914CBE1AE05AF63A8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

16:b8:52:34:21:86:4d:99:36:9a:40:96:34:44:ca:57:f1:59:6b:01:f7:98:2a:93:a1:ac:35:44:94:eb:cb:fe

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Chains

Oct 26, 2026

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Minor OS version

Major OS version

Entry point

5691991

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\projects_pc\cod\codsrc\src\obj\t5\CoDSteam_CEG_bin\BlackOps.pdb

steam_api

SteamAPI_RegisterCallResult SteamAPI_Shutdown SteamAPI_UnregisterCallback SteamAPI_UnregisterCallResult SteamAPI_RunCallbacks SteamAPI_RestartAppIfNecessary SteamAPI_Init SteamApps SteamGameServer SteamGameServer_RunCallbacks SteamMasterServerUpdater SteamGameServer_Init SteamGameServer_Shutdown SteamNetworking SteamUserStats SteamAPI_RegisterCallback SteamUtils SteamUser SteamFriends

winmm

mixerSetControlDetails timeEndPeriod timeBeginPeriod mixerGetControlDetailsA mixerGetLineControlsA mixerClose mixerGetLineInfoA mixerOpen mixerGetNumDevs waveInGetNumDevs timeGetTime

wsock32

recvfrom select gethostname WSAStartup sendto closesocket htons ioctlsocket gethostbyname WSAGetLastError socket

binkw32

_BinkRegisterFrameBuffers@8 _BinkSetSoundSystem@8 _BinkClose@4 _BinkGetError@0 _BinkOpen@8 _BinkSetSoundTrack@8 _BinkSetIOSize@4 _BinkDoFrame@4 _BinkSetMemory@8 _BinkWait@4 _BinkOpenDirectSound@4 _BinkControlBackgroundIO@8 _BinkSetVolume@12 _BinkPause@8 _BinkShouldSkip@4 _BinkGetFrameBuffersInfo@8 _BinkNextFrame@4 _BinkGetRealtime@12

d3d9

Direct3DCreate9 D3DPERF_BeginEvent D3DPERF_EndEvent

d3dx9_43

D3DXCompileShader D3DXSaveSurfaceToFileA D3DXCreateBuffer D3DXGetShaderConstantTable D3DXGetShaderInputSemantics D3DXGetShaderOutputSemantics

dsound

ord11 ord6

kernel32

GetLocaleInfoA GetStringTypeW GetStringTypeA FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetEnvironmentVariableW SetEnvironmentVariableA InitializeCriticalSectionAndSpinCount VirtualQuery GetFileType SetHandleCount FlushFileBuffers GetConsoleMode GetConsoleCP HeapCreate GetStdHandle SetStdHandle WriteConsoleA QueryPerformanceCounter InterlockedDecrement CreateFileA ReadFileEx GetLastError SleepEx CloseHandle GetFileSize GetFileAttributesA InterlockedIncrement DebugBreak ExitProcess GetCurrentThreadId SwitchToThread InterlockedExchange GetCurrentProcess GetProcAddress GetModuleHandleA LoadLibraryA RaiseException Sleep SetEvent ResetEvent CreateEventA WaitForSingleObject GetProcessAffinityMask DuplicateHandle GetCurrentThread CreateThread SuspendThread ResumeThread SetThreadPriority SetFileAttributesA VirtualAlloc VirtualFree QueryPerformanceFrequency GetModuleFileNameA InitializeCriticalSection EnterCriticalSection TryEnterCriticalSection LeaveCriticalSection GetCurrentDirectoryA GlobalMemoryStatus SetProcessAffinityMask GetThreadPriority FormatMessageA OutputDebugStringA GetDriveTypeA GetConsoleOutputCP GlobalSize GlobalLock GetVersionExA Module32Next Module32First CreateToolhelp32Snapshot OpenProcess WriteFile ReadFile GetCurrentProcessId DeleteFileA SetErrorMode SetUnhandledExceptionFilter DeleteCriticalSection TerminateProcess GetTickCount MulDiv SetPriorityClass SetThreadExecutionState FreeLibrary WideCharToMultiByte ReleaseMutex ReleaseSemaphore CreateMutexA CreateSemaphoreA SetFilePointer PulseEvent SetLastError CreateEventW GetProcessTimes GetModuleHandleExA GetFileTime HeapFree GetProcessHeap GetFileInformationByHandle CreateFileW lstrcmpiW lstrlenW GetFullPathNameW HeapAlloc HeapSize GetTimeZoneInformation GetComputerNameA GetSystemTime FileTimeToSystemTime GetSystemTimeAsFileTime InterlockedCompareExchange GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW UnmapViewOfFile LockResource LoadResource SizeofResource FindResourceW GetConsoleWindow GetCurrentDirectoryW GetEnvironmentStringsW GetCommandLineW GetStartupInfoW GetFullPathNameA MapViewOfFile CreateFileMappingA OpenFileMappingA OpenEventA GetSystemInfo FindNextFileA GetModuleHandleW ExitThread MultiByteToWideChar HeapReAlloc GetCommandLineA GetStartupInfoA GetCPInfo GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree LCMapStringA LCMapStringW WriteConsoleW CompareStringA CompareStringW SetEndOfFile TerminateThread GetExitCodeThread FindFirstFileA FileTimeToLocalFileTime FindClose CreateDirectoryA IsDebuggerPresent UnhandledExceptionFilter MoveFileA GlobalUnlock RtlUnwind

user32

RegisterClassA DefWindowProcA DestroyWindow PostQuitMessage CallWindowProcA SetWindowTextA CloseWindow CallNextHookEx GetAsyncKeyState SetWindowsHookExA MapVirtualKeyA MoveWindow GetMonitorInfoA MonitorFromWindow RegisterWindowMessageA LoadImageA LoadIconA LoadCursorA RegisterClassExA AdjustWindowRect OpenClipboard GetClipboardData CloseClipboard GetMessageA DispatchMessageA TranslateMessage ShowWindow PostMessageA ShowCursor ClientToScreen GetCursorPos CreateWindowExA SendMessageA ScreenToClient GetForegroundWindow SetFocus SetCursorPos GetActiveWindow MessageBoxA ChangeDisplaySettingsA EnumThreadWindows GetDesktopWindow SetWindowPos GetDC ReleaseDC GetWindowTextA SetWindowLongA GetWindowLongA GetWindowRect AdjustWindowRectEx IsWindow MonitorFromPoint EnumDisplayMonitors PeekMessageA MessageBoxW GetSystemMetrics

gdi32

DeleteDC CreateFontA ExtEscape SetDeviceGammaRamp GetDeviceCaps CreateDCA CreateSolidBrush

advapi32

CryptReleaseContext CryptAcquireContextA CryptGenRandom InitializeSecurityDescriptor SetSecurityDescriptorDacl RegQueryValueExW RegOpenKeyExW RegCloseKey OpenProcessToken OpenThreadToken AdjustTokenPrivileges LookupPrivilegeValueA

shell32

SHGetFolderPathA ShellExecuteA

ole32

StringFromGUID2 CoInitializeEx CoUninitialize CLSIDFromString CoTaskMemAlloc CoTaskMemFree CoCreateInstance

xinput1_3

ord3 ord4 ord2

psapi

GetProcessMemoryInfo

ws2_32

connect ioctlsocket setsockopt bind ntohs send inet_ntoa recv __WSAFDIsSet getsockname

Name

.text

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

233KB

Virtual Size

59.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

109B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.version

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_d904d1eef08503e40f022308fb9a5660_amadey_coinminer_elex_smoke-loader_stop

steam_api

winmm

wsock32

binkw32

d3d9

d3dx9_43

dsound

kernel32

user32

gdi32

advapi32

shell32

ole32

xinput1_3

psapi

ws2_32

generic