General
- Target 2026-08-05_257ffbba434e530968f9ae6f6221659a_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee
- Size 1.7MB
- Sample260805-jsd6maxyhs
- SHA256 039079165e054a63155fd1db50c2747dfc327f40ad4c7cf52a8d921ad0a48c9a
- MD5 257ffbba434e530968f9ae6f6221659a
- SHA1 b7a3ebd7627f793a0599f7930383a2fbe10d377c
- SHA512 0ad051b260c806f5d232c43906eed792d3a4b7356833d5291aac180f275a6fe086cbac998517da09df12eedbd6464a4cd13c54821bcf36191d6264c1af1d696a
- SSDEEP 24576:gvO2xJKRw2kOkx2LFRvcU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:gHHKe2WQX56/OJdJCXDrsOFZMjHfUr
- TLSH T199858D31AAC04132E2B3867585FA56F6A9257C222721E5CF62C57B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-05_257ffbba434e530968f9ae6f6221659a_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_257ffbba434e530968f9ae6f6221659a_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260709-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-05_257ffbba434e530968f9ae6f6221659a_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee
- Size 1.7MB
- SHA256 039079165e054a63155fd1db50c2747dfc327f40ad4c7cf52a8d921ad0a48c9a
- MD5 257ffbba434e530968f9ae6f6221659a
- SHA1 b7a3ebd7627f793a0599f7930383a2fbe10d377c
- SHA512 0ad051b260c806f5d232c43906eed792d3a4b7356833d5291aac180f275a6fe086cbac998517da09df12eedbd6464a4cd13c54821bcf36191d6264c1af1d696a
- SSDEEP 24576:gvO2xJKRw2kOkx2LFRvcU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:gHHKe2WQX56/OJdJCXDrsOFZMjHfUr
- TLSH T199858D31AAC04132E2B3867585FA56F6A9257C222721E5CF62C57B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detection of CryptoLocker Variants
-
Detection of Cryptolocker Samples
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory