General
- Target 2026-08-01_2ea08a4746948c4e5b15f10b99dfd51d_amadey_coinminer_elex_glassworm_remcos_smoke-loader_stop
- Size 1.1MB
- Sample260802-exgebss1dz
- SHA256 45c5390b6b37317d71ba20309d26f6a9502f8031f3999cefe36ea8f10b5cdb52
- MD5 2ea08a4746948c4e5b15f10b99dfd51d
- SHA1 b50a9391379c65d3c3a0cfa0ad5dd19e2f3d51a7
- SHA512 c2698083e06c3472c9b5fdd3be397e4228e5c67944f27a64d79ad13072dad949587c102d028f2a4cf9cf27faf7129755e5c2b77dd946157d35567f5454ce36bc
- SSDEEP 24576:mvO2xJKRh2kOkx2LFxNcUQPxuZ98Es8kQ:mHHKX2WQt5QZuTr
- TLSH T160358C31E641C036D4A74576C6BA4BBFA578BD21032555C7E3C43E6A2FB22D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-01_2ea08a4746948c4e5b15f10b99dfd51d_amadey_coinminer_elex_glassworm_remcos_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_2ea08a4746948c4e5b15f10b99dfd51d_amadey_coinminer_elex_glassworm_remcos_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_2ea08a4746948c4e5b15f10b99dfd51d_amadey_coinminer_elex_glassworm_remcos_smoke-loader_stop
- Size 1.1MB
- SHA256 45c5390b6b37317d71ba20309d26f6a9502f8031f3999cefe36ea8f10b5cdb52
- MD5 2ea08a4746948c4e5b15f10b99dfd51d
- SHA1 b50a9391379c65d3c3a0cfa0ad5dd19e2f3d51a7
- SHA512 c2698083e06c3472c9b5fdd3be397e4228e5c67944f27a64d79ad13072dad949587c102d028f2a4cf9cf27faf7129755e5c2b77dd946157d35567f5454ce36bc
- SSDEEP 24576:mvO2xJKRh2kOkx2LFxNcUQPxuZ98Es8kQ:mHHKX2WQt5QZuTr
- TLSH T160358C31E641C036D4A74576C6BA4BBFA578BD21032555C7E3C43E6A2FB22D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory