General
- Target 2026-07-19_4121c697dd6beac2232a30899bcc6a62_amadey_coinminer_elex_remcos_smoke-loader_stop
- Size 873KB
- Sample260720-bz9bcad19y
- SHA256 748f81d1f8f186e72aac97603b662048a3b218a5f39fda05d03c0c23133deb2c
- MD5 4121c697dd6beac2232a30899bcc6a62
- SHA1 f8c7dc5dd0bf63ae8668c0462877360cf44947e4
- SHA512 ea1489cda52d3205a3de4e91eef9c1d4d9e28b5631cf9a72f4b723b1ff8b2a21724cf389fd4d931109b6e85a5c74bb6c83af1ba02c0dce66894296dca079c5d7
- SSDEEP 12288:qSvO2x9mONvKRhLSFtsOkx2LIaeyk5FAQjU/Lik8CQ3uEW:xvO2xJKRh2kOkx2LFxNcUQPxW
- TLSH T1A6156B31E641C036D0A34576C6FA4BBFE964BD25531165CBA3D43A262FB32D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-19_4121c697dd6beac2232a30899bcc6a62_amadey_coinminer_elex_remcos_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-19_4121c697dd6beac2232a30899bcc6a62_amadey_coinminer_elex_remcos_smoke-loader_stop
- Size 873KB
- SHA256 748f81d1f8f186e72aac97603b662048a3b218a5f39fda05d03c0c23133deb2c
- MD5 4121c697dd6beac2232a30899bcc6a62
- SHA1 f8c7dc5dd0bf63ae8668c0462877360cf44947e4
- SHA512 ea1489cda52d3205a3de4e91eef9c1d4d9e28b5631cf9a72f4b723b1ff8b2a21724cf389fd4d931109b6e85a5c74bb6c83af1ba02c0dce66894296dca079c5d7
- SSDEEP 12288:qSvO2x9mONvKRhLSFtsOkx2LIaeyk5FAQjU/Lik8CQ3uEW:xvO2xJKRh2kOkx2LFxNcUQPxW
- TLSH T1A6156B31E641C036D0A34576C6FA4BBFE964BD25531165CBA3D43A262FB32D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory