General
- Target 2026-06-28_559c56cb0e4076a4e54c59dd97d0e691_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 871KB
- Sample260630-sy37dact7s
- SHA256 6c75f22f3e1d0191b19e1b1f306cb2a38cd61e9732eb9c3491e9c8a2f12dd651
- MD5 559c56cb0e4076a4e54c59dd97d0e691
- SHA1 f8aa0178d45a0078cb186477320b97847dc4e64f
- SHA512 1dc9c7002b1f49258c80fb77416658df3187e68e68a3455c51e60df487285488fdaaf5fca37bfbfd54dde7d3ee8457d0624cc568330235990545e5dc6b0886e1
- SSDEEP 12288:8SvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikGU5rCOTeidT:PvO2xJKRI2FOkx2LFEvcU6UQOJdT
- TLSH T1C7156B31E681C036D5B34571C6FA4BBBA9647D21531165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-28_559c56cb0e4076a4e54c59dd97d0e691_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_559c56cb0e4076a4e54c59dd97d0e691_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win11ltsc2024-20260630-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-28_559c56cb0e4076a4e54c59dd97d0e691_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 871KB
- SHA256 6c75f22f3e1d0191b19e1b1f306cb2a38cd61e9732eb9c3491e9c8a2f12dd651
- MD5 559c56cb0e4076a4e54c59dd97d0e691
- SHA1 f8aa0178d45a0078cb186477320b97847dc4e64f
- SHA512 1dc9c7002b1f49258c80fb77416658df3187e68e68a3455c51e60df487285488fdaaf5fca37bfbfd54dde7d3ee8457d0624cc568330235990545e5dc6b0886e1
- SSDEEP 12288:8SvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikGU5rCOTeidT:PvO2xJKRI2FOkx2LFEvcU6UQOJdT
- TLSH T1C7156B31E681C036D5B34571C6FA4BBBA9647D21531165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detection of CryptoLocker Variants
- Custom signature
Detection of Cryptolocker Samples
Executes dropped EXE
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Drops file in System32 directory