General
- Target 2026-05-23_c377986b556e742bbbec914054aea987_amadey_coinminer_cryptolocker_elex_graphican_rhadamanthys_smoke-loader_stop
- Size 743KB
- Sample260523-wcbf1sav9x
- SHA256 5654656ae272b74369c068b9d92ea8334a9fe03c75cedec35b8c3cffb6682db0
- MD5 c377986b556e742bbbec914054aea987
- SHA1 1c162d7eec88cf458932149f890b5a4011675f46
- SHA512 a55fe4b625f4d2d3fd89c0a41dfccc53dcd7ef7d383047d8406cb20c4c85485c0fc5892b209474425c1f5bb1bff80d203d88a4a7f778c6b07c3eb5da818e5ea9
- SSDEEP 12288:aSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikG8:BvO2xJKRI2FOkx2LFEvcU68
- TLSH T1F6F45A31E2418036D5B34576C6FA0BBFB5647D25131165CBA3C8BA262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-05-23_c377986b556e742bbbec914054aea987_amadey_coinminer_cryptolocker_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-23_c377986b556e742bbbec914054aea987_amadey_coinminer_cryptolocker_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Resource
win11-20260513-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-23_c377986b556e742bbbec914054aea987_amadey_coinminer_cryptolocker_elex_graphican_rhadamanthys_smoke-loader_stop
- Size 743KB
- SHA256 5654656ae272b74369c068b9d92ea8334a9fe03c75cedec35b8c3cffb6682db0
- MD5 c377986b556e742bbbec914054aea987
- SHA1 1c162d7eec88cf458932149f890b5a4011675f46
- SHA512 a55fe4b625f4d2d3fd89c0a41dfccc53dcd7ef7d383047d8406cb20c4c85485c0fc5892b209474425c1f5bb1bff80d203d88a4a7f778c6b07c3eb5da818e5ea9
- SSDEEP 12288:aSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikG8:BvO2xJKRI2FOkx2LFEvcU68
- TLSH T1F6F45A31E2418036D5B34576C6FA0BBFB5647D25131165CBA3C8BA262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detection of CryptoLocker Variants
- Custom signature
Detection of Cryptolocker Samples
Executes dropped EXE
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Drops file in System32 directory