General
- Target 2026-07-31_dcd64c47f01dd929e96fb0e1b06280db_amadey_coinminer_elex_glassworm_lolbot_quasar-rat_remcos_smoke-loader_stop_wannacry
- Size 2.2MB
- Sample260731-cykr2a1hrg
- SHA256 9fb4fdfccff91055b9992dc10ec6f08e7a892ce7146676e5297b3288f5834e31
- MD5 dcd64c47f01dd929e96fb0e1b06280db
- SHA1 6a67e4f1583ad025880fa4ae5f21f1c96b06a052
- SHA512 6154f45e87774ef0f9768ea15197c67a824d5dd124d476aadf8332834465f7d8430733de12c25a45933dbde02050da693f08d97554a8c63eec5bd47adde978d4
- SSDEEP 24576:96DvO2xJKRw2kOkx2LFRvcUQPxuZ98GgDhdkMRWfLTUO2Zu1um5ev8pIA4Wnh2w:9EHHKe2WQX5QZuT+dkMgl2Zu7ev2I22w
- TLSH T151B5B021B6E09532C1AF41B08275467E97F57C219353B6CBF3C0FAA52EB27E19A31217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-31_dcd64c47f01dd929e96fb0e1b06280db_amadey_coinminer_elex_glassworm_lolbot_quasar-rat_remcos.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_dcd64c47f01dd929e96fb0e1b06280db_amadey_coinminer_elex_glassworm_lolbot_quasar-rat_remcos.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-31_dcd64c47f01dd929e96fb0e1b06280db_amadey_coinminer_elex_glassworm_lolbot_quasar-rat_remcos_smoke-loader_stop_wannacry
- Size 2.2MB
- SHA256 9fb4fdfccff91055b9992dc10ec6f08e7a892ce7146676e5297b3288f5834e31
- MD5 dcd64c47f01dd929e96fb0e1b06280db
- SHA1 6a67e4f1583ad025880fa4ae5f21f1c96b06a052
- SHA512 6154f45e87774ef0f9768ea15197c67a824d5dd124d476aadf8332834465f7d8430733de12c25a45933dbde02050da693f08d97554a8c63eec5bd47adde978d4
- SSDEEP 24576:96DvO2xJKRw2kOkx2LFRvcUQPxuZ98GgDhdkMRWfLTUO2Zu1um5ev8pIA4Wnh2w:9EHHKe2WQX5QZuT+dkMgl2Zu7ev2I22w
- TLSH T151B5B021B6E09532C1AF41B08275467E97F57C219353B6CBF3C0FAA52EB27E19A31217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
AutoIT Executable
AutoIT scripts compiled to PE executables.