General
- Target 2026-07-17_423a2b49e9f7b702044b5c50715f0a48_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop
- Size 3.3MB
- Sample260717-bd91ragz8k
- SHA256 dce85cfa13673dc754674dd89f687da348d79e7e2359c0d745fb5dea54ce56f2
- MD5 423a2b49e9f7b702044b5c50715f0a48
- SHA1 1fe13c58d807a9417ee2cdbd6d7281bddbaee17f
- SHA512 05c6e708412afdca670023da2737df8ca3c612ae074b8429e3adcd62e91e3d82d5a9e94280086889896dc20858bad8aa9909dc1b6c17d5fa0c66b2b248082785
- SSDEEP 24576:UvO2xJKRI2dOkx2LFAC///wjHPOnOkx2LFhJbKkKF/eMNPjxdnQbzU:UHHKO2FQN///wTGHQd9KFeMxQbzU
- TLSH T1C4F54B12FB90C636D16A573048AB439A6BB5FD405B128BDF62D4B31F0F732869E31E58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-17_423a2b49e9f7b702044b5c50715f0a48_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_423a2b49e9f7b702044b5c50715f0a48_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-17_423a2b49e9f7b702044b5c50715f0a48_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop
- Size 3.3MB
- SHA256 dce85cfa13673dc754674dd89f687da348d79e7e2359c0d745fb5dea54ce56f2
- MD5 423a2b49e9f7b702044b5c50715f0a48
- SHA1 1fe13c58d807a9417ee2cdbd6d7281bddbaee17f
- SHA512 05c6e708412afdca670023da2737df8ca3c612ae074b8429e3adcd62e91e3d82d5a9e94280086889896dc20858bad8aa9909dc1b6c17d5fa0c66b2b248082785
- SSDEEP 24576:UvO2xJKRI2dOkx2LFAC///wjHPOnOkx2LFhJbKkKF/eMNPjxdnQbzU:UHHKO2FQN///wTGHQd9KFeMxQbzU
- TLSH T1C4F54B12FB90C636D16A573048AB439A6BB5FD405B128BDF62D4B31F0F732869E31E58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory