General
- Target 2026-07-15_393566d6c4d44a57cd542a226613bd3e_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee
- Size 1.7MB
- Sample260715-frl83acs5m
- SHA256 e76991aa9dd9e950d06d470ffa15f4ba391e6083b899fe75f5a7ded35c252e83
- MD5 393566d6c4d44a57cd542a226613bd3e
- SHA1 fbcfb9029fab8598c41d9520c9b792577ea9fae0
- SHA512 144b669fed71b05400a660764ba0879a729e1470a06b382a475b506fbded689fa0651f38bfe7629be940299c0b4902430ab8ebc4114e16404f0d66b337b5335b
- SSDEEP 24576:DvO2xJKRw2kOkx2LFRvcU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:DHHKe2WQX56/OJdJCXDrsOFZMjHfUr
- TLSH T1E3858D31AAC04132E2B3867585FA56F6A9257C222721E5CF62C57B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-15_393566d6c4d44a57cd542a226613bd3e_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_393566d6c4d44a57cd542a226613bd3e_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260709-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-15_393566d6c4d44a57cd542a226613bd3e_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee
- Size 1.7MB
- SHA256 e76991aa9dd9e950d06d470ffa15f4ba391e6083b899fe75f5a7ded35c252e83
- MD5 393566d6c4d44a57cd542a226613bd3e
- SHA1 fbcfb9029fab8598c41d9520c9b792577ea9fae0
- SHA512 144b669fed71b05400a660764ba0879a729e1470a06b382a475b506fbded689fa0651f38bfe7629be940299c0b4902430ab8ebc4114e16404f0d66b337b5335b
- SSDEEP 24576:DvO2xJKRw2kOkx2LFRvcU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:DHHKe2WQX56/OJdJCXDrsOFZMjHfUr
- TLSH T1E3858D31AAC04132E2B3867585FA56F6A9257C222721E5CF62C57B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detection of CryptoLocker Variants
-
Detection of Cryptolocker Samples
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory