General
- Target 2026-04-18_018450c40bd01ab62a6a46d8fc5ee373_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.3MB
- Sample260418-c9affafs8w
- SHA256 d50457fc1e458bf436803e7654758b1881df3e4d119fa4aee1d331af20d3fd8b
- MD5 018450c40bd01ab62a6a46d8fc5ee373
- SHA1 45e09e68667ac8261ecc143bf7e5fbff972cc4e5
- SHA512 4598ab9d8848a9ca0b16e8b05a8b8b02a85211b3c7bf88cdc93bedfffcc4525cb185cf777667e73d921cc7e1f1d8be16332bfec3ae14974b7ee9deeb429df5c6
- SSDEEP 24576:NvO2xJKRI2FOkx2LFEvcU6UQOJdBqsCPhH9Do2sl:NHHKO29QG56/OJdJCXDrsl
- TLSH T126559E32A6808036E5B3467586FA57BAA5257C215321E1CF73C47A2E1FB37D3A93170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-04-18_018450c40bd01ab62a6a46d8fc5ee373_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win10v2004-20260130-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-18_018450c40bd01ab62a6a46d8fc5ee373_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win11-20260130-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-18_018450c40bd01ab62a6a46d8fc5ee373_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.3MB
- SHA256 d50457fc1e458bf436803e7654758b1881df3e4d119fa4aee1d331af20d3fd8b
- MD5 018450c40bd01ab62a6a46d8fc5ee373
- SHA1 45e09e68667ac8261ecc143bf7e5fbff972cc4e5
- SHA512 4598ab9d8848a9ca0b16e8b05a8b8b02a85211b3c7bf88cdc93bedfffcc4525cb185cf777667e73d921cc7e1f1d8be16332bfec3ae14974b7ee9deeb429df5c6
- SSDEEP 24576:NvO2xJKRI2FOkx2LFEvcU6UQOJdBqsCPhH9Do2sl:NHHKO29QG56/OJdJCXDrsl
- TLSH T126559E32A6808036E5B3467586FA57BAA5257C215321E1CF73C47A2E1FB37D3A93170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detection of CryptoLocker Variants
-
Detection of Cryptolocker Samples
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory