General
- Target 2026-07-29_deed19106b3166e49be41dc487575c1f_amadey_coinminer_darkgate_elex_glassworm_kwampirs_mafia_remcos_smoke-loader
- Size 3.1MB
- Sample260730-b4ktjsbj9z
- SHA256 f3dcc01cde30437bc486bdefa5b92da8e86313b4f774f89d149fb9ebd3f412e4
- MD5 deed19106b3166e49be41dc487575c1f
- SHA1 f50c9be6349244c4a1ef67fa555615181574ecbd
- SHA512 0ebbf1680fc7dc6f8110d2fec32f4dce3c677da81a918935afe0a7a2b4db99c9627a06b962aa1d65c923bf08581e9455e8b51b6aa0e02539355bf4682742b1b0
- SSDEEP 49152:iTGkQ35QZuTtS0rQMYOQ+q8CEOTG4QwTGHQS90:iKkwWsM0r1QnRK4xKH9e
- TLSH T15FE5AE12F350C035C4AB463589BB47AE5639BD214B2157CBA7C47BAE1FB32C16E35B0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-29_deed19106b3166e49be41dc487575c1f_amadey_coinminer_darkgate_elex_glassworm_kwampirs_mafia_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_deed19106b3166e49be41dc487575c1f_amadey_coinminer_darkgate_elex_glassworm_kwampirs_mafia_remcos_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-29_deed19106b3166e49be41dc487575c1f_amadey_coinminer_darkgate_elex_glassworm_kwampirs_mafia_remcos_smoke-loader
- Size 3.1MB
- SHA256 f3dcc01cde30437bc486bdefa5b92da8e86313b4f774f89d149fb9ebd3f412e4
- MD5 deed19106b3166e49be41dc487575c1f
- SHA1 f50c9be6349244c4a1ef67fa555615181574ecbd
- SHA512 0ebbf1680fc7dc6f8110d2fec32f4dce3c677da81a918935afe0a7a2b4db99c9627a06b962aa1d65c923bf08581e9455e8b51b6aa0e02539355bf4682742b1b0
- SSDEEP 49152:iTGkQ35QZuTtS0rQMYOQ+q8CEOTG4QwTGHQS90:iKkwWsM0r1QnRK4xKH9e
- TLSH T15FE5AE12F350C035C4AB463589BB47AE5639BD214B2157CBA7C47BAE1FB32C16E35B0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory