General
- Target 2026-05-10_7757b906e17d6c947a1ddf780aafdefd_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee
- Size 1.7MB
- Sample260511-acgr5sgv31
- SHA256 cae6b6226222ecb58e214b75dbf7cfa7de4941207577b464b00762af1e71d220
- MD5 7757b906e17d6c947a1ddf780aafdefd
- SHA1 eca2d5d463d336d0dc7d29611c4a24b2b15a92d8
- SHA512 0c9fe03180ce745c8e4004b7fabb1382c993b14371c6e58a4609bb03515ec39074f4f19b16deda07cd6c22015d5f69467b9ea46eaa9eb7e9dc6b9bbe82076cd0
- SSDEEP 24576:PvO2xJKRw2kOkx2LFRvcU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:PHHKe2WQX56/OJdJCXDrsOFZMjHfUr
- TLSH T141858D31AAC04132E2B3867585FA56F6A9257C222721E5CF62C57B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-05-10_7757b906e17d6c947a1ddf780aafdefd_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-10_7757b906e17d6c947a1ddf780aafdefd_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee.exe
Resource
win11-20260130-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-10_7757b906e17d6c947a1ddf780aafdefd_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee
- Size 1.7MB
- SHA256 cae6b6226222ecb58e214b75dbf7cfa7de4941207577b464b00762af1e71d220
- MD5 7757b906e17d6c947a1ddf780aafdefd
- SHA1 eca2d5d463d336d0dc7d29611c4a24b2b15a92d8
- SHA512 0c9fe03180ce745c8e4004b7fabb1382c993b14371c6e58a4609bb03515ec39074f4f19b16deda07cd6c22015d5f69467b9ea46eaa9eb7e9dc6b9bbe82076cd0
- SSDEEP 24576:PvO2xJKRw2kOkx2LFRvcU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:PHHKe2WQX56/OJdJCXDrsOFZMjHfUr
- TLSH T141858D31AAC04132E2B3867585FA56F6A9257C222721E5CF62C57B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detection of CryptoLocker Variants
-
Detection of Cryptolocker Samples
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory