General
- Target 2026-04-15_17a614df6b922c43d847f40a068c5c9c_coinminer_elex_emotet_icedid_poet-rat_remcos
- Size 3.6MB
- Sample260415-ppdnksgz2s
- SHA256 4e1b7235fa7c885be71b0dfbf1e5393e5e8c1255bc05ea2058c4b415650a1964
- MD5 17a614df6b922c43d847f40a068c5c9c
- SHA1 9b07477c429246fbe4c2275c769144208b4712cd
- SHA512 2dd0b12f1e2ac1d55e15a3c376238fdd7d00c008c890aa8abce9180e616791e8e7ce4c3cc20d111c0337f2235b0ae05c26fcffc62a6bb564e5d8a35288b7112b
- SSDEEP 49152:IylFHUv6ReIt0jSrOVQZKVr2Dt7i+/yTE:DlFHU85t0jSbAwhrSE
- TLSH T1C406D83037EA5208E5B60B311D7AB6D11A7E7E667E14CA5E3069860CCD32653CB23B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_17a614df6b922c43d847f40a068c5c9c_coinminer_elex_emotet_icedid_poet-rat_remcos.exe
Resource
win10v2004-20260130-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_17a614df6b922c43d847f40a068c5c9c_coinminer_elex_emotet_icedid_poet-rat_remcos.exe
Resource
win11-20260130-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-15_17a614df6b922c43d847f40a068c5c9c_coinminer_elex_emotet_icedid_poet-rat_remcos
- Size 3.6MB
- SHA256 4e1b7235fa7c885be71b0dfbf1e5393e5e8c1255bc05ea2058c4b415650a1964
- MD5 17a614df6b922c43d847f40a068c5c9c
- SHA1 9b07477c429246fbe4c2275c769144208b4712cd
- SHA512 2dd0b12f1e2ac1d55e15a3c376238fdd7d00c008c890aa8abce9180e616791e8e7ce4c3cc20d111c0337f2235b0ae05c26fcffc62a6bb564e5d8a35288b7112b
- SSDEEP 49152:IylFHUv6ReIt0jSrOVQZKVr2Dt7i+/yTE:DlFHU85t0jSbAwhrSE
- TLSH T1C406D83037EA5208E5B60B311D7AB6D11A7E7E667E14CA5E3069860CCD32653CB23B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE