General
- Target 2026-08-01_8e1bc62869f67f313d3b71f7dd417bcd_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop_vidar
- Size 4.9MB
- Sample260802-akeyhsam3y
- SHA256 4c055136849f7e5272609fe299ec9acdd3df2e650c28fb930928b91011d36bef
- MD5 8e1bc62869f67f313d3b71f7dd417bcd
- SHA1 3791a7d6e015bd61ad214e2f9caa25d052abea35
- SHA512 2379020c7eebf4c66c25b0bba1fa26415511f3c34d27fa77c0becaf7df5dc89b856358c80bb64214eaa826cace3dfe4198bc8df1e9b236e885f86a63f3b33e4e
- SSDEEP 98304:EcRGTJNjoyxQeMjLsAAa/7JNzJwjI5klUigT:3GTJJoReGZF6bUpT
- TLSH T18636F106F65442B5C077C0B9C993DA7AFA713842473086CB5395EB6EAF336D19A3A331
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_8e1bc62869f67f313d3b71f7dd417bcd_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_8e1bc62869f67f313d3b71f7dd417bcd_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_8e1bc62869f67f313d3b71f7dd417bcd_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop_vidar
- Size 4.9MB
- SHA256 4c055136849f7e5272609fe299ec9acdd3df2e650c28fb930928b91011d36bef
- MD5 8e1bc62869f67f313d3b71f7dd417bcd
- SHA1 3791a7d6e015bd61ad214e2f9caa25d052abea35
- SHA512 2379020c7eebf4c66c25b0bba1fa26415511f3c34d27fa77c0becaf7df5dc89b856358c80bb64214eaa826cace3dfe4198bc8df1e9b236e885f86a63f3b33e4e
- SSDEEP 98304:EcRGTJNjoyxQeMjLsAAa/7JNzJwjI5klUigT:3GTJJoReGZF6bUpT
- TLSH T18636F106F65442B5C077C0B9C993DA7AFA713842473086CB5395EB6EAF336D19A3A331
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory