General
- Target 2026-08-04_5b56ca16c12774ce49f46b077b387e15_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 560KB
- Sample260804-hzg1esfa37
- SHA256 fb06a4e62d8cce6117343c4dc8bb9ea03ee17f600dc20ca905e6157bc6d0216c
- MD5 5b56ca16c12774ce49f46b077b387e15
- SHA1 18e51c5fc2f5a9188399953f5e2e8e8203c12136
- SHA512 60c553cb6e7ac7b09b45c72a58c55a56b4340c6f6dc51b6a9c73c1c3514205f538337bb8cee948296a38784d25b3c34a098269fb444f80c404b9928149c7013b
- SSDEEP 12288:q3Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:KVOL4/gPXKCOkx2LFR
- TLSH T141C46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-04_5b56ca16c12774ce49f46b077b387e15_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_5b56ca16c12774ce49f46b077b387e15_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_5b56ca16c12774ce49f46b077b387e15_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 560KB
- SHA256 fb06a4e62d8cce6117343c4dc8bb9ea03ee17f600dc20ca905e6157bc6d0216c
- MD5 5b56ca16c12774ce49f46b077b387e15
- SHA1 18e51c5fc2f5a9188399953f5e2e8e8203c12136
- SHA512 60c553cb6e7ac7b09b45c72a58c55a56b4340c6f6dc51b6a9c73c1c3514205f538337bb8cee948296a38784d25b3c34a098269fb444f80c404b9928149c7013b
- SSDEEP 12288:q3Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:KVOL4/gPXKCOkx2LFR
- TLSH T141C46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory