General
- Target 2026-06-26_d94a76c601a9b19b20caf8eed6f023a7_amadey_coinminer_elex_glassworm_luca-stealer_njrat_remcos_revil_smoke-loader
- Size 3.7MB
- Sample260629-n16m3act5w
- SHA256 39d6d91adc5a7e032a5034cb39c8889a00b5a4cb6d7515d6eae96ce314b8f6dd
- MD5 d94a76c601a9b19b20caf8eed6f023a7
- SHA1 a0454be019f5a953517dd73c3df1482a1142d05b
- SHA512 0238a4c4e6b97c2ef46a14d62fb027a5b0bd74ab476f0f3670c0b8d3bede9734d44228b6ca72a1e9bfdeea25d904613f85821df950f4b434104a17185b0ff895
- SSDEEP 49152:ufEV3ugKeuWoAkf6bRexQlNIdwB0pJCWJ0+1NaZPwqT5eZPai:ufEYnnfKthWq+1OwZPai
- TLSH T1DE06AEC2BB834471F8A736B511AB63BE5D7D69130728D4C393D429A94C316D0AE3B39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-06-26_d94a76c601a9b19b20caf8eed6f023a7_amadey_coinminer_elex_glassworm_luca-stealer_njrat_remcos_revil_smoke-loader.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_d94a76c601a9b19b20caf8eed6f023a7_amadey_coinminer_elex_glassworm_luca-stealer_njrat_remcos_revil_smoke-loader.exe
Resource
win11ltsc2024-20260629-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-26_d94a76c601a9b19b20caf8eed6f023a7_amadey_coinminer_elex_glassworm_luca-stealer_njrat_remcos_revil_smoke-loader
- Size 3.7MB
- SHA256 39d6d91adc5a7e032a5034cb39c8889a00b5a4cb6d7515d6eae96ce314b8f6dd
- MD5 d94a76c601a9b19b20caf8eed6f023a7
- SHA1 a0454be019f5a953517dd73c3df1482a1142d05b
- SHA512 0238a4c4e6b97c2ef46a14d62fb027a5b0bd74ab476f0f3670c0b8d3bede9734d44228b6ca72a1e9bfdeea25d904613f85821df950f4b434104a17185b0ff895
- SSDEEP 49152:ufEV3ugKeuWoAkf6bRexQlNIdwB0pJCWJ0+1NaZPwqT5eZPai:ufEYnnfKthWq+1OwZPai
- TLSH T1DE06AEC2BB834471F8A736B511AB63BE5D7D69130728D4C393D429A94C316D0AE3B39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.