General
- Target 2026-07-21_0c6fdf0d23e41f1358e27519342ee966_amadey_coinminer_elex_emotet_glassworm_remcos_smoke-loader_stop
- Size 10.7MB
- Sample260721-s8gfcszbrc
- SHA256 d7ef4732917a2e0741b2244c6a2a5c555fd74263479dda863eb4cb63bec8f275
- MD5 0c6fdf0d23e41f1358e27519342ee966
- SHA1 a2b1165fee133231490435a728c26f268e675011
- SHA512 5c32faef18584bd77028837f7d0b095ed90a7fdb8fa98f6671b9b638a7b62377ec8424193a0c44c4c866425628ca41a0e420e23ad2be35fbd98645462f5fe74e
- SSDEEP 196608:eBSK1kzxJVZN0vFKzAeqpKY8HY+5BH5c9BDal:Up6xpNMwzJUqz/5c9s
- TLSH T1A9B60123E2018552E0650D7041736F787AF59F629EA1C8A3E7D4FDE93E72361E62720E
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-21_0c6fdf0d23e41f1358e27519342ee966_amadey_coinminer_elex_emotet_glassworm_remcos_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-21_0c6fdf0d23e41f1358e27519342ee966_amadey_coinminer_elex_emotet_glassworm_remcos_smoke-loader_stop
- Size 10.7MB
- SHA256 d7ef4732917a2e0741b2244c6a2a5c555fd74263479dda863eb4cb63bec8f275
- MD5 0c6fdf0d23e41f1358e27519342ee966
- SHA1 a2b1165fee133231490435a728c26f268e675011
- SHA512 5c32faef18584bd77028837f7d0b095ed90a7fdb8fa98f6671b9b638a7b62377ec8424193a0c44c4c866425628ca41a0e420e23ad2be35fbd98645462f5fe74e
- SSDEEP 196608:eBSK1kzxJVZN0vFKzAeqpKY8HY+5BH5c9BDal:Up6xpNMwzJUqz/5c9s
- TLSH T1A9B60123E2018552E0650D7041736F787AF59F629EA1C8A3E7D4FDE93E72361E62720E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Windows executables referencing non-Windows User-Agents
-
UPX dump on OEP (original entry point)
-
Loads dropped DLL
-
Suspicious use of NtSetInformationThreadHideFromDebugger