General
- Target 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop_vidar
- Size 5.4MB
- Sample260802-j3gphayapf
- SHA256 116b7a2697dcd923adcecab90b038d65e0d36b224aa699cc5d823078a6683fde
- MD5 a9122fa3f38fa524ed2d969773872197
- SHA1 3c7cdc31cd7c03e5ee5f87043bedece5e369d6c7
- SHA512 7b28ed3acd3ec793dfde5a6a4f736ca9cbbade822eda78966bf0d038f3d62c5af867fb9025d7a81f20418c0432977f8497698a4a3895dd233df702a4f982fae7
- SSDEEP 98304:EcRGTJNjoyxQeMjLsAAa/7JNzJwjI5klUigAWjo/:3GTJJoReGZF6bUpjo/
- TLSH T1E246BE12F564C235D07385B9C9A69BBAEA313D525B3089C76381FB6D2F336D28536332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop_vidar
- Size 5.4MB
- SHA256 116b7a2697dcd923adcecab90b038d65e0d36b224aa699cc5d823078a6683fde
- MD5 a9122fa3f38fa524ed2d969773872197
- SHA1 3c7cdc31cd7c03e5ee5f87043bedece5e369d6c7
- SHA512 7b28ed3acd3ec793dfde5a6a4f736ca9cbbade822eda78966bf0d038f3d62c5af867fb9025d7a81f20418c0432977f8497698a4a3895dd233df702a4f982fae7
- SSDEEP 98304:EcRGTJNjoyxQeMjLsAAa/7JNzJwjI5klUigAWjo/:3GTJJoReGZF6bUpjo/
- TLSH T1E246BE12F564C235D07385B9C9A69BBAEA313D525B3089C76381FB6D2F336D28536332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory