General
- Target 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 560KB
- Sample260629-dpvrbac13q
- SHA256 0d1d284d0e733f02d77e85a459b14012a01001df8e81b2805f25866e846dc86c
- MD5 c332e1c481ca429168709795513e239d
- SHA1 2a6029830df6eb95a3d7bbf4fd7a1d7c94baebc8
- SHA512 77dc2ad269a0624c7c4904a54dc29e08f2602dd0d6e1e868100850a163767fabe77bb15880d569ad5f6aa79c234b63f4f8bf398c305fe5e1ca1fbc35d9f16779
- SSDEEP 12288:c3Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:QVOL4/gPXKCOkx2LFR
- TLSH T127C46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 560KB
- SHA256 0d1d284d0e733f02d77e85a459b14012a01001df8e81b2805f25866e846dc86c
- MD5 c332e1c481ca429168709795513e239d
- SHA1 2a6029830df6eb95a3d7bbf4fd7a1d7c94baebc8
- SHA512 77dc2ad269a0624c7c4904a54dc29e08f2602dd0d6e1e868100850a163767fabe77bb15880d569ad5f6aa79c234b63f4f8bf398c305fe5e1ca1fbc35d9f16779
- SSDEEP 12288:c3Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:QVOL4/gPXKCOkx2LFR
- TLSH T127C46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory