General
- Target 2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwampirs_mafia_remcos_rhadamanthys_smoke-loader_stop
- Size 4.8MB
- Sample260804-mgf3mattay
- SHA256 224dada9eed1544c2f9e6f65fa9a130133e38cb854f2d838237e50d0cb45442b
- MD5 a42a6de3eeb82e2449dd5438871b7f88
- SHA1 b0e5b943a3728c56ca6db3cf21d59da364f2cc92
- SHA512 269ef554738d4ca460ca805d47d806857c8f2728c083001ea4b239ac1f7a2e5a8656f77e4417331182e3c34aea60a8c3d6c0deed7aba06856ccd8f8500c35923
- SSDEEP 49152:wHHKO29Ql5QZuTtS0rQMYOQ+q8CEPfTG4Q2TGHQe9KFeMx///x:wnKdmWsM0r1QnIK4PKHd0FeS///x
- TLSH T1F2367D12B780C236D4AA473189AF43AA5778FD114B2687CB7384772E1E736D29F31B19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Resource
win11ltsc2024-20260710-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwampirs_mafia_remcos_rhadamanthys_smoke-loader_stop
- Size 4.8MB
- SHA256 224dada9eed1544c2f9e6f65fa9a130133e38cb854f2d838237e50d0cb45442b
- MD5 a42a6de3eeb82e2449dd5438871b7f88
- SHA1 b0e5b943a3728c56ca6db3cf21d59da364f2cc92
- SHA512 269ef554738d4ca460ca805d47d806857c8f2728c083001ea4b239ac1f7a2e5a8656f77e4417331182e3c34aea60a8c3d6c0deed7aba06856ccd8f8500c35923
- SSDEEP 49152:wHHKO29Ql5QZuTtS0rQMYOQ+q8CEPfTG4Q2TGHQe9KFeMx///x:wnKdmWsM0r1QnIK4PKHd0FeS///x
- TLSH T1F2367D12B780C236D4AA473189AF43AA5778FD114B2687CB7384772E1E736D29F31B19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
UPX dump on OEP (original entry point)
Executes dropped EXE
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Drops file in System32 directory