General
- Target 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.3MB
- Sample260420-jz97msgx6y
- SHA256 d8444717f8927a6c22f9289c3e75db40af0587de9428cecedeb46232d2dd239f
- MD5 84867c5578d52e7369ab5ae624adf324
- SHA1 9aa50c82830934d353817d7299ab5a0acec70005
- SHA512 87c89c459d4e9bd53ddf251a8852ab8cd908974bf059996cae96f38c7a792cfa82e68b6c37ffe4e5654a6254f3333f7283cac0e7431905a338aa85bc8421f364
- SSDEEP 24576:KvO2xJKRI2FOkx2LFEvcU6UQOJdBqsCPhH9Do2sl:KHHKO29QG56/OJdJCXDrsl
- TLSH T1C0559E32A6808036E5B3467586FA57BAA5257C215321E1CF73C47A2E1FB37D3A93170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win10v2004-20260130-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win11-20260130-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.3MB
- SHA256 d8444717f8927a6c22f9289c3e75db40af0587de9428cecedeb46232d2dd239f
- MD5 84867c5578d52e7369ab5ae624adf324
- SHA1 9aa50c82830934d353817d7299ab5a0acec70005
- SHA512 87c89c459d4e9bd53ddf251a8852ab8cd908974bf059996cae96f38c7a792cfa82e68b6c37ffe4e5654a6254f3333f7283cac0e7431905a338aa85bc8421f364
- SSDEEP 24576:KvO2xJKRI2FOkx2LFEvcU6UQOJdBqsCPhH9Do2sl:KHHKO29QG56/OJdJCXDrsl
- TLSH T1C0559E32A6808036E5B3467586FA57BAA5257C215321E1CF73C47A2E1FB37D3A93170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detection of CryptoLocker Variants
- Custom signature
Detection of Cryptolocker Samples
Executes dropped EXE
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Drops file in System32 directory