General
- Target 2026-08-03_2824b7d2c92209ec9209b57d8fb4e0e3_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 560KB
- Sample260803-pc72naxbpg
- SHA256 56884e410e8a29e6dfca73344e83f325090627f6b009dfe77c6011cbbf004744
- MD5 2824b7d2c92209ec9209b57d8fb4e0e3
- SHA1 8eee32dcc4889f366b8a11f7179c0b39ae72ae73
- SHA512 12c7b57fbee7550c96c00bf25e1919990bbd925270547811733fb1025c935ad86f98c949cc4493905d34a38d0bde858481bf9bec004f93ee42803ef56aeccbdb
- SSDEEP 12288:q3Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:KVOL4/gPXKCOkx2LFR
- TLSH T11BC46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-03_2824b7d2c92209ec9209b57d8fb4e0e3_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_2824b7d2c92209ec9209b57d8fb4e0e3_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 560KB
- SHA256 56884e410e8a29e6dfca73344e83f325090627f6b009dfe77c6011cbbf004744
- MD5 2824b7d2c92209ec9209b57d8fb4e0e3
- SHA1 8eee32dcc4889f366b8a11f7179c0b39ae72ae73
- SHA512 12c7b57fbee7550c96c00bf25e1919990bbd925270547811733fb1025c935ad86f98c949cc4493905d34a38d0bde858481bf9bec004f93ee42803ef56aeccbdb
- SSDEEP 12288:q3Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:KVOL4/gPXKCOkx2LFR
- TLSH T11BC46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Custom signature
UPX dump on OEP (original entry point)
Executes dropped EXE
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Drops file in System32 directory