General
- Target 2026-07-08_0c5bb779fdb7c9b92e8670ff70ad91b6_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry
- Size 8.2MB
- Sample260708-2mpz2sa18y
- SHA256 297aad3f34ef440d6cc7203c7277b265f5830d8cfa3aeb366b6874759d02e53b
- MD5 0c5bb779fdb7c9b92e8670ff70ad91b6
- SHA1 8b861a1064f3ead09dbda4d6b5568e0f111bf661
- SHA512 c61e39f0876336b6f26c1a172470d16829eb9caf1c013424776029d3f92d39bbb1e16181e27213a7838510a8a067581130d7a32e19a722e9cb773c97e0df278d
- SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
- TLSH T19096F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-08_0c5bb779fdb7c9b92e8670ff70ad91b6_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-08_0c5bb779fdb7c9b92e8670ff70ad91b6_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry
- Size 8.2MB
- SHA256 297aad3f34ef440d6cc7203c7277b265f5830d8cfa3aeb366b6874759d02e53b
- MD5 0c5bb779fdb7c9b92e8670ff70ad91b6
- SHA1 8b861a1064f3ead09dbda4d6b5568e0f111bf661
- SHA512 c61e39f0876336b6f26c1a172470d16829eb9caf1c013424776029d3f92d39bbb1e16181e27213a7838510a8a067581130d7a32e19a722e9cb773c97e0df278d
- SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
- TLSH T19096F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
mimikatz is an open source tool to dump credentials on Windows
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.