d29772519328cfd4994aeb9d451499954d5110a18eeb36f9fd82ea1746a518d3

General

Target
2026-07-09_ecf445701b3c997855c0973b99857078_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee
Size 1.1MB
Sample260709-jm3a9set5m
SHA256 d29772519328cfd4994aeb9d451499954d5110a18eeb36f9fd82ea1746a518d3
MD5 ecf445701b3c997855c0973b99857078
SHA1 bd8cb56d2f4698f275c10ba8131995fe5c3c856c
SHA512 da042124a1e72d9934691d9be7cd42f4911f8701e3f1651b836607238a32401527413f139074b48bd7bd1fe7f61166333395c9446af54ee38a2676aec77616f8
SSDEEP 12288:BSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidzN/VTg:IvO2xJKRw2kOkx2LFRvcU6UQOJdM
TLSH
T1D0357C31A681C036D5B34571C6FA4BBBA9747D25131165CBA3C47A2A2FB37D2BA3130E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-09_ecf445701b3c997855c0973b99857078_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee
- Size 1.1MB
- SHA256 d29772519328cfd4994aeb9d451499954d5110a18eeb36f9fd82ea1746a518d3
- MD5 ecf445701b3c997855c0973b99857078
- SHA1 bd8cb56d2f4698f275c10ba8131995fe5c3c856c
- SHA512 da042124a1e72d9934691d9be7cd42f4911f8701e3f1651b836607238a32401527413f139074b48bd7bd1fe7f61166333395c9446af54ee38a2676aec77616f8
- SSDEEP 12288:BSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidzN/VTg:IvO2xJKRw2kOkx2LFRvcU6UQOJdM
- TLSH
  T1D0357C31A681C036D5B34571C6FA4BBBA9747D25131165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery spyware trojan upx adware persistence ransomware
- Custom signature
  
  Detection of CryptoLocker Variants
- Custom signature
  
  Detection of Cryptolocker Samples
- Custom signature
  
  UPX dump on OEP (original entry point)
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2