General
- Target 2026-05-09_caef287b6efb2eadfba42dcbdb095d97_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 871KB
- Sample260509-xc25eab16w
- SHA256 e06386e86522e01ecd94c39b63804ab791e876ba9ba209efae69ab5f8b23b041
- MD5 caef287b6efb2eadfba42dcbdb095d97
- SHA1 516c27f8caa2fed4d20508f2d977181771a32919
- SHA512 71c1b2acac2d2c73b6fc43584e969db15c28636bb06de2cf29e01f63a954ce3698abf8dc80f9a247ff6453559ccceffd46d3cfe3dd10b4cf3049f9dab075fd31
- SSDEEP 12288:NSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikGU5rCOTeidT:MvO2xJKRI2FOkx2LFEvcU6UQOJdT
- TLSH T170156B31E681C036D5B34571C6FA4BBBA9647D21531165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-05-09_caef287b6efb2eadfba42dcbdb095d97_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win10v2004-20260130-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-09_caef287b6efb2eadfba42dcbdb095d97_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win11-20260130-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-09_caef287b6efb2eadfba42dcbdb095d97_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 871KB
- SHA256 e06386e86522e01ecd94c39b63804ab791e876ba9ba209efae69ab5f8b23b041
- MD5 caef287b6efb2eadfba42dcbdb095d97
- SHA1 516c27f8caa2fed4d20508f2d977181771a32919
- SHA512 71c1b2acac2d2c73b6fc43584e969db15c28636bb06de2cf29e01f63a954ce3698abf8dc80f9a247ff6453559ccceffd46d3cfe3dd10b4cf3049f9dab075fd31
- SSDEEP 12288:NSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikGU5rCOTeidT:MvO2xJKRI2FOkx2LFEvcU6UQOJdT
- TLSH T170156B31E681C036D5B34571C6FA4BBBA9647D21531165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detection of CryptoLocker Variants
-
Detection of Cryptolocker Samples
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory