General
- Target 2026-05-07_a876302405d70accc96b23c949b65381_amadey_coinminer_cryptolocker_elex_graphican_rhadamanthys_smoke-loader_stop
- Size 743KB
- Sample260507-e4tm8sey8s
- SHA256 0f4acce10c83b64fcbd9e4efb14546d56218389fba8730d37904c7ead0d88b17
- MD5 a876302405d70accc96b23c949b65381
- SHA1 e05b47ce8d70930a2495c58c157a522e5e4fe256
- SHA512 d776d3cb78ec437e5c81312102ba7fccbacee73a16a3e7f3279cd09a3ec332ed1a31e3a9f7ea20403d754bce450f4202e64701cf5febd8619cc50fa6697d6747
- SSDEEP 12288:/SvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikG8:KvO2xJKRI2FOkx2LFEvcU68
- TLSH T1A9F45A31E2418036D5B34576C6FA0BBFB5647D25131165CBA3C8BA262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-05-07_a876302405d70accc96b23c949b65381_amadey_coinminer_cryptolocker_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-07_a876302405d70accc96b23c949b65381_amadey_coinminer_cryptolocker_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Resource
win11-20260130-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-07_a876302405d70accc96b23c949b65381_amadey_coinminer_cryptolocker_elex_graphican_rhadamanthys_smoke-loader_stop
- Size 743KB
- SHA256 0f4acce10c83b64fcbd9e4efb14546d56218389fba8730d37904c7ead0d88b17
- MD5 a876302405d70accc96b23c949b65381
- SHA1 e05b47ce8d70930a2495c58c157a522e5e4fe256
- SHA512 d776d3cb78ec437e5c81312102ba7fccbacee73a16a3e7f3279cd09a3ec332ed1a31e3a9f7ea20403d754bce450f4202e64701cf5febd8619cc50fa6697d6747
- SSDEEP 12288:/SvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikG8:KvO2xJKRI2FOkx2LFEvcU68
- TLSH T1A9F45A31E2418036D5B34576C6FA0BBFB5647D25131165CBA3C8BA262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detection of CryptoLocker Variants
-
Detection of Cryptolocker Samples
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory