General
- Target 2026-07-23_d106edd1eea83609a562e77d3ff307a5_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee
- Size 1.7MB
- Sample260723-t9fe5a1vfx
- SHA256 f69bcd51576ccc868f4b1b6d5e2bdb508bdcf733d8a05f426a0c9e3fc166d17f
- MD5 d106edd1eea83609a562e77d3ff307a5
- SHA1 5cbda5cb396bcec0f23d9dfc2f186ed2aae09263
- SHA512 4249d6229bce8bd249bfe3ced6915bba8e64234776b40d46a5d7d347025850b41ec97cd57b7763c0b2a4c73dd30e932ba662e8e8391704b40b8c9e58bcf5c37a
- SSDEEP 24576:nvO2xJKRw2kOkx2LFRvcU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:nHHKe2WQX56/OJdJCXDrsOFZMjHfUr
- TLSH T192858D31AAC04132E2B3867585FA56F6A9257C222721E5CF62C57B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-23_d106edd1eea83609a562e77d3ff307a5_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_d106edd1eea83609a562e77d3ff307a5_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee
- Size 1.7MB
- SHA256 f69bcd51576ccc868f4b1b6d5e2bdb508bdcf733d8a05f426a0c9e3fc166d17f
- MD5 d106edd1eea83609a562e77d3ff307a5
- SHA1 5cbda5cb396bcec0f23d9dfc2f186ed2aae09263
- SHA512 4249d6229bce8bd249bfe3ced6915bba8e64234776b40d46a5d7d347025850b41ec97cd57b7763c0b2a4c73dd30e932ba662e8e8391704b40b8c9e58bcf5c37a
- SSDEEP 24576:nvO2xJKRw2kOkx2LFRvcU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:nHHKe2WQX56/OJdJCXDrsOFZMjHfUr
- TLSH T192858D31AAC04132E2B3867585FA56F6A9257C222721E5CF62C57B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detection of CryptoLocker Variants
-
Detection of Cryptolocker Samples
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory