General
- Target 2026-07-21_b77f38e59990ce1ba30e0ab5ee82e44d_amadey_coinminer_darkgate_elex_glassworm_graphican_kwampirs_mafia_remcos_rhadamanthys_smoke-loader_stop
- Size 3.0MB
- Sample260721-ef3agafw3t
- SHA256 a9d12b62260021a3a8fa39e77b7bd144b5fb7511dbe90e5e50d33c5d030176fb
- MD5 b77f38e59990ce1ba30e0ab5ee82e44d
- SHA1 99031683e42dfbba635edb3104e3595e9d821ed3
- SHA512 30bb45323d6b5c29ae9a9fbfe255b92dbc9df00ea5a09b6752dd094049483b8b39005bd6d971e598588dce87f15c1e8cafb1bf7217e19235b7f7999a16158501
- SSDEEP 49152:7HHKO29QG5QZuTtS0rQMYOQ+q8CEOTG4QmTGHQv9KFeMz:7nKdBWsM0r1Qn1K4XKH40Feq
- TLSH T13DE59D12F7A0C036C4A7027589BA476EA678BD614B2547CBB3C47B2E5F723D16E3530A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-21_b77f38e59990ce1ba30e0ab5ee82e44d_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-21_b77f38e59990ce1ba30e0ab5ee82e44d_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-21_b77f38e59990ce1ba30e0ab5ee82e44d_amadey_coinminer_darkgate_elex_glassworm_graphican_kwampirs_mafia_remcos_rhadamanthys_smoke-loader_stop
- Size 3.0MB
- SHA256 a9d12b62260021a3a8fa39e77b7bd144b5fb7511dbe90e5e50d33c5d030176fb
- MD5 b77f38e59990ce1ba30e0ab5ee82e44d
- SHA1 99031683e42dfbba635edb3104e3595e9d821ed3
- SHA512 30bb45323d6b5c29ae9a9fbfe255b92dbc9df00ea5a09b6752dd094049483b8b39005bd6d971e598588dce87f15c1e8cafb1bf7217e19235b7f7999a16158501
- SSDEEP 49152:7HHKO29QG5QZuTtS0rQMYOQ+q8CEOTG4QmTGHQv9KFeMz:7nKdBWsM0r1Qn1K4XKH40Feq
- TLSH T13DE59D12F7A0C036C4A7027589BA476EA678BD614B2547CBB3C47B2E5F723D16E3530A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
UPX dump on OEP (original entry point)
Executes dropped EXE
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Drops file in System32 directory