ad75de9cad7a3a856fa769a7b5c44b11b11f34b2ea5b4ed92a6cded755952bd2

General

Target
2026-06-25_cbbc5ad0762433656eb0130bd98d8a65_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
Size 851KB
Sample260629-yjsd8ad12y
SHA256 ad75de9cad7a3a856fa769a7b5c44b11b11f34b2ea5b4ed92a6cded755952bd2
MD5 cbbc5ad0762433656eb0130bd98d8a65
SHA1 43d1ea73f35a23c28a1c2bdfab3e8b63d30dd8b5
SHA512 40a44f4454183ff87a2a16d7ff827170569022aebbe7e6b9a330d16f8c158f84a056c30723c9effc9f1755b468c650e13b4eb0ee7c3343b64e3895b3b0ef980f
SSDEEP 12288:CmhjrdUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxoJRK2:1hHalj3DSudvGM3MXTVhtSQWGtxov7
TLSH
T1B705F111B1408031F36607304969EAE04A1EAD795BE4E0CFF7A87D7A2E716D39A7721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-25_cbbc5ad0762433656eb0130bd98d8a65_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 851KB
- SHA256 ad75de9cad7a3a856fa769a7b5c44b11b11f34b2ea5b4ed92a6cded755952bd2
- MD5 cbbc5ad0762433656eb0130bd98d8a65
- SHA1 43d1ea73f35a23c28a1c2bdfab3e8b63d30dd8b5
- SHA512 40a44f4454183ff87a2a16d7ff827170569022aebbe7e6b9a330d16f8c158f84a056c30723c9effc9f1755b468c650e13b4eb0ee7c3343b64e3895b3b0ef980f
- SSDEEP 12288:CmhjrdUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxoJRK2:1hHalj3DSudvGM3MXTVhtSQWGtxov7
- TLSH
  T1B705F111B1408031F36607304969EAE04A1EAD795BE4E0CFF7A87D7A2E716D39A7721F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery upx adware persistence spyware
- Custom signature
  
  Detects Reflective DLL injection artifacts
- Custom signature
  
  Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- Custom signature
  
  UPX dump on OEP (original entry point)
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2