General
- Target 2026-08-03_f7b45177042b4511bbcee083bd1927cb_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee
- Size 1.1MB
- Sample260804-ktjm6swcpd
- SHA256 0411d958823ba457a3783a8460ff1d27f8c8f315cb7f28c4c2ec0edb54e66ca9
- MD5 f7b45177042b4511bbcee083bd1927cb
- SHA1 f8c4dde82dc19b64571144eb2ba007e871da22ae
- SHA512 6730ad29155c288b97f90ed911ecd26d5b8be7a8006d181724a281d38bf2276f9ec08af4ab8446aaaf704c682d547b792ad78f15af88e3dc3bbede30cd6a0860
- SSDEEP 12288:DSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidzN/VTg:2vO2xJKRw2kOkx2LFRvcU6UQOJdM
- TLSH T113357C31A681C036D5B34571C6FA4BBBA9747D25131165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-03_f7b45177042b4511bbcee083bd1927cb_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_f7b45177042b4511bbcee083bd1927cb_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260709-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_f7b45177042b4511bbcee083bd1927cb_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee
- Size 1.1MB
- SHA256 0411d958823ba457a3783a8460ff1d27f8c8f315cb7f28c4c2ec0edb54e66ca9
- MD5 f7b45177042b4511bbcee083bd1927cb
- SHA1 f8c4dde82dc19b64571144eb2ba007e871da22ae
- SHA512 6730ad29155c288b97f90ed911ecd26d5b8be7a8006d181724a281d38bf2276f9ec08af4ab8446aaaf704c682d547b792ad78f15af88e3dc3bbede30cd6a0860
- SSDEEP 12288:DSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidzN/VTg:2vO2xJKRw2kOkx2LFRvcU6UQOJdM
- TLSH T113357C31A681C036D5B34571C6FA4BBBA9747D25131165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detection of CryptoLocker Variants
-
Detection of Cryptolocker Samples
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory