General
- Target 2026-07-30_db793f12a17ec7a3ddb201fb1e3f7cf3_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 560KB
- Sample260730-day57a1whv
- SHA256 904fa67c01e23d91103aec125f2bb6406f644f0941012d94b3c4167a55e4406e
- MD5 db793f12a17ec7a3ddb201fb1e3f7cf3
- SHA1 e3839ad104c03b16ba5e18d981ff975b204dbbea
- SHA512 7d0069a3704a96ea0c5762c852d1c38ddc4ea0bce1c5298257abcdc93c100eec0efe3e4a80a2b48a66c4709ea202cdbd5f484e39eed41961c5a5721470486ccc
- SSDEEP 12288:l3Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:3VOL4/gPXKCOkx2LFR
- TLSH T126C46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-30_db793f12a17ec7a3ddb201fb1e3f7cf3_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-30_db793f12a17ec7a3ddb201fb1e3f7cf3_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 560KB
- SHA256 904fa67c01e23d91103aec125f2bb6406f644f0941012d94b3c4167a55e4406e
- MD5 db793f12a17ec7a3ddb201fb1e3f7cf3
- SHA1 e3839ad104c03b16ba5e18d981ff975b204dbbea
- SHA512 7d0069a3704a96ea0c5762c852d1c38ddc4ea0bce1c5298257abcdc93c100eec0efe3e4a80a2b48a66c4709ea202cdbd5f484e39eed41961c5a5721470486ccc
- SSDEEP 12288:l3Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:3VOL4/gPXKCOkx2LFR
- TLSH T126C46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory