General
- Target 2026-05-06_e1f5b88f9c4e38a564ca0712a052e761_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 871KB
- Sample260506-js6kwahs2m
- SHA256 3f9c2bdd1c8941ec551c1b1df97565a4cef1cf78a1de59188ae47ae5da7bd59e
- MD5 e1f5b88f9c4e38a564ca0712a052e761
- SHA1 a5350132e3e0d6ad2508c61419fc2a92808cf614
- SHA512 10ff94974c4013c9e89b5229eb335ca3da2b2bff05a9185c89685dbc1710e88b77d87f25824e1e8495a3e6b0cf004b1dccfbcd0eb8cc0cb6baae517b1cd5bd4d
- SSDEEP 12288:2SvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikGU5rCOTeidT:1vO2xJKRI2FOkx2LFEvcU6UQOJdT
- TLSH T105156B31E681C036D5B34571C6FA4BBBA9647D21531165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-05-06_e1f5b88f9c4e38a564ca0712a052e761_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win10v2004-20260130-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-06_e1f5b88f9c4e38a564ca0712a052e761_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win11-20250502-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-06_e1f5b88f9c4e38a564ca0712a052e761_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 871KB
- SHA256 3f9c2bdd1c8941ec551c1b1df97565a4cef1cf78a1de59188ae47ae5da7bd59e
- MD5 e1f5b88f9c4e38a564ca0712a052e761
- SHA1 a5350132e3e0d6ad2508c61419fc2a92808cf614
- SHA512 10ff94974c4013c9e89b5229eb335ca3da2b2bff05a9185c89685dbc1710e88b77d87f25824e1e8495a3e6b0cf004b1dccfbcd0eb8cc0cb6baae517b1cd5bd4d
- SSDEEP 12288:2SvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikGU5rCOTeidT:1vO2xJKRI2FOkx2LFEvcU6UQOJdT
- TLSH T105156B31E681C036D5B34571C6FA4BBBA9647D21531165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detection of CryptoLocker Variants
- Custom signature
Detection of Cryptolocker Samples
Executes dropped EXE
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Drops file in System32 directory