General
- Target 2026-08-02_9d4a4a001f7717399f772bfc76fb59b1_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop_vidar
- Size 5.3MB
- Sample260802-j5ctbsfe83
- SHA256 1589d5995048cd797a924456db4d08257cbe9542d275a74c1503c08d2db204a6
- MD5 9d4a4a001f7717399f772bfc76fb59b1
- SHA1 ecf58217942acf271aee4ca14076719c7a08a739
- SHA512 70151cfb3a0d9002b69a67f25dcbbbd4d571ed97e023fc9c4e3d85b1f336be9841aea5cb093767cd68d60ab0ef90b02198b1cd757403abbe0dc059400b77e65b
- SSDEEP 98304:EcRGTJNjoyxQeMjLsAAa/7JNzJwjI5klUig4joq:3GTJJoReGZF6bUpaoq
- TLSH T14546E016F66486B1D073C079C4D2D7BAEA7238424B30C6CB5395D76D2F276E29A3A331
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_9d4a4a001f7717399f772bfc76fb59b1_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_9d4a4a001f7717399f772bfc76fb59b1_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_9d4a4a001f7717399f772bfc76fb59b1_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop_vidar
- Size 5.3MB
- SHA256 1589d5995048cd797a924456db4d08257cbe9542d275a74c1503c08d2db204a6
- MD5 9d4a4a001f7717399f772bfc76fb59b1
- SHA1 ecf58217942acf271aee4ca14076719c7a08a739
- SHA512 70151cfb3a0d9002b69a67f25dcbbbd4d571ed97e023fc9c4e3d85b1f336be9841aea5cb093767cd68d60ab0ef90b02198b1cd757403abbe0dc059400b77e65b
- SSDEEP 98304:EcRGTJNjoyxQeMjLsAAa/7JNzJwjI5klUig4joq:3GTJJoReGZF6bUpaoq
- TLSH T14546E016F66486B1D073C079C4D2D7BAEA7238424B30C6CB5395D76D2F276E29A3A331
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory