General
- Target 2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 871KB
- Sample260418-djsd1afw4y
- SHA256 28ed21196fbdccf5b32a0ea9d6ce4b65fe76455674749611a353e1258cb60c10
- MD5 46bf3944be05ceb50b5e594ba041a1fe
- SHA1 3e5b20cfcd7acc28eb342f8ee636872a509b1ac8
- SHA512 a1e4ebec81fb385459353d6ce55c956df612bb844b1c151eb9dfb15f185535e47fe9b42cc9177c963e5ee1dbd52b9d66a9fe8d15aded61a26ac545b3c6e6538e
- SSDEEP 12288:hSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikGU5rCOTeidT:ovO2xJKRI2FOkx2LFEvcU6UQOJdT
- TLSH T136156B31E681C036D5B34571C6FA4BBBA9647D21531165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win10v2004-20260130-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win11-20260130-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 871KB
- SHA256 28ed21196fbdccf5b32a0ea9d6ce4b65fe76455674749611a353e1258cb60c10
- MD5 46bf3944be05ceb50b5e594ba041a1fe
- SHA1 3e5b20cfcd7acc28eb342f8ee636872a509b1ac8
- SHA512 a1e4ebec81fb385459353d6ce55c956df612bb844b1c151eb9dfb15f185535e47fe9b42cc9177c963e5ee1dbd52b9d66a9fe8d15aded61a26ac545b3c6e6538e
- SSDEEP 12288:hSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikGU5rCOTeidT:ovO2xJKRI2FOkx2LFEvcU6UQOJdT
- TLSH T136156B31E681C036D5B34571C6FA4BBBA9647D21531165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detection of CryptoLocker Variants
- Custom signature
Detection of Cryptolocker Samples
Executes dropped EXE
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Drops file in System32 directory