General
- Target 2026-05-03_48018260914b3fde8b254d1690a6c669_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.3MB
- Sample260503-mf12eaaw2k
- SHA256 6b2e8e0db691221d8c30876574f025f1ec7c51e3259382a3b38d67556a39acea
- MD5 48018260914b3fde8b254d1690a6c669
- SHA1 a86b0501df5d9bf9359e0af14f3498946ac8075b
- SHA512 8088d6b89c176c6a6e1463b4b21c850da37f4bde1e497c07ac0c53c12f32944ef2c46bfa8cc775acff974ad59b879945854e0e77dc8c6c535ae73bdaae7a2ded
- SSDEEP 24576:2vO2xJKRI2FOkx2LFEvcU6UQOJdBqsCPhH9Do2sl:2HHKO29QG56/OJdJCXDrsl
- TLSH T178559E32A6808036E5B3467586FA57BAA5257C215321E1CF73C47A2E1FB37D3A93170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-05-03_48018260914b3fde8b254d1690a6c669_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win10v2004-20260130-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-03_48018260914b3fde8b254d1690a6c669_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win11-20260130-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-03_48018260914b3fde8b254d1690a6c669_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.3MB
- SHA256 6b2e8e0db691221d8c30876574f025f1ec7c51e3259382a3b38d67556a39acea
- MD5 48018260914b3fde8b254d1690a6c669
- SHA1 a86b0501df5d9bf9359e0af14f3498946ac8075b
- SHA512 8088d6b89c176c6a6e1463b4b21c850da37f4bde1e497c07ac0c53c12f32944ef2c46bfa8cc775acff974ad59b879945854e0e77dc8c6c535ae73bdaae7a2ded
- SSDEEP 24576:2vO2xJKRI2FOkx2LFEvcU6UQOJdBqsCPhH9Do2sl:2HHKO29QG56/OJdJCXDrsl
- TLSH T178559E32A6808036E5B3467586FA57BAA5257C215321E1CF73C47A2E1FB37D3A93170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detection of CryptoLocker Variants
- Custom signature
Detection of Cryptolocker Samples
Executes dropped EXE
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Drops file in System32 directory