General
- Target 2026-08-03_9459b42a9b68d9d6fb4d15b6098ae6fc_amadey_coinminer_elex_glassworm_kwampirs_mafia_remcos_smoke-loader
- Size 1024KB
- Sample260803-v1yqsach77
- SHA256 89234007f11dca249ce937378c0b417d4321ca0ae4708ff06f04d83f494174ab
- MD5 9459b42a9b68d9d6fb4d15b6098ae6fc
- SHA1 05e07e4547ef133166ecc3de15096981a7f075af
- SHA512 02882bdbae97aee89f4a51b882dc81ed19d56ca52857a8d3f80b9d9f3f9a9b3868f06d4c93a3f3760fb9c8848225fe69079fb3c666e501061e67f1b5f0b960cb
- SSDEEP 24576:zjHPOSOkx2LFscUQPxuZ98Es8k3OH3C0rQ6+y:zTGkQy5QZuTtS0rQi
- TLSH T199259E31E242C03AD5A70172C6BE4BBF95687D25432961C7A3D43D762FB62D2AA3170F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-03_9459b42a9b68d9d6fb4d15b6098ae6fc_amadey_coinminer_elex_glassworm_kwampirs_mafia_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_9459b42a9b68d9d6fb4d15b6098ae6fc_amadey_coinminer_elex_glassworm_kwampirs_mafia_remcos_smoke-loader
- Size 1024KB
- SHA256 89234007f11dca249ce937378c0b417d4321ca0ae4708ff06f04d83f494174ab
- MD5 9459b42a9b68d9d6fb4d15b6098ae6fc
- SHA1 05e07e4547ef133166ecc3de15096981a7f075af
- SHA512 02882bdbae97aee89f4a51b882dc81ed19d56ca52857a8d3f80b9d9f3f9a9b3868f06d4c93a3f3760fb9c8848225fe69079fb3c666e501061e67f1b5f0b960cb
- SSDEEP 24576:zjHPOSOkx2LFscUQPxuZ98Es8k3OH3C0rQ6+y:zTGkQy5QZuTtS0rQi
- TLSH T199259E31E242C03AD5A70172C6BE4BBF95687D25432961C7A3D43D762FB62D2AA3170F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory