General
- Target 2026-07-15_64cb32ecc32a2ef2848df21fdcdab3dc_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop
- Size 1.2MB
- Sample260715-xbbk3afv4s
- SHA256 19fb939362ca5338a26e6a0de0536212a9cf8fcc4c9e134ed0b9832f5fa74c6f
- MD5 64cb32ecc32a2ef2848df21fdcdab3dc
- SHA1 583ca91c6e033cfc7ef75322e76b8286c69c42e2
- SHA512 880ae206d142a3f756f3538a92dbc3b198c25392e9c8c58d43ad75d6848889d205be038cf08bbb5583a6178adc5d1dc65105f37f352bae9ee09a22d9f3df8ba0
- SSDEEP 24576:YvO2xJKRh2kOkx2LFxNcUQPxuZ98Es8k3OH3C0rQ6+y:YHHKX2WQt5QZuTtS0rQi
- TLSH T166558D31E641C036D5A70175C6BA4BBFA5787D21032565CBE3D43E6A2FB22D2AA3170F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-15_64cb32ecc32a2ef2848df21fdcdab3dc_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_64cb32ecc32a2ef2848df21fdcdab3dc_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-15_64cb32ecc32a2ef2848df21fdcdab3dc_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop
- Size 1.2MB
- SHA256 19fb939362ca5338a26e6a0de0536212a9cf8fcc4c9e134ed0b9832f5fa74c6f
- MD5 64cb32ecc32a2ef2848df21fdcdab3dc
- SHA1 583ca91c6e033cfc7ef75322e76b8286c69c42e2
- SHA512 880ae206d142a3f756f3538a92dbc3b198c25392e9c8c58d43ad75d6848889d205be038cf08bbb5583a6178adc5d1dc65105f37f352bae9ee09a22d9f3df8ba0
- SSDEEP 24576:YvO2xJKRh2kOkx2LFxNcUQPxuZ98Es8k3OH3C0rQ6+y:YHHKX2WQt5QZuTtS0rQi
- TLSH T166558D31E641C036D5A70175C6BA4BBFA5787D21032565CBE3D43E6A2FB22D2AA3170F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory