General
- Target 2026-08-08_8aebaa49d1ccb37cb2b05d2b3e1f4b43_amadey_coinminer_darkgate_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 4.6MB
- Sample260808-dqasjaygjb
- SHA256 11c35464b154791785d17d8a179aceb10286f1a8875e1a402ffff0ae48705936
- MD5 8aebaa49d1ccb37cb2b05d2b3e1f4b43
- SHA1 5e6d0c6b5f45f2eecf49cda6a07c88a04087c87e
- SHA512 094d4291f48f4d0fe29f9a1de55461f9b98910e9526d9bfce7e0b81a5b55b8bd778ee82d7df2384dcbcf36ccb985b3f38054d96567d5d606945061e2a8aaca24
- SSDEEP 49152:T2aDHXAWSytLoqUCInTUCIabjKoh9WEbtL2tLlZqhaK6zbfqdlIhKPgssSt2gTBn:+stsF7IabjKoh9WyV2Vlx/hv7St0OgPK
- TLSH T128368D217BF48075E1B795B1A9BA8366D9727C604B7086CF6390773E1F32AD05A72323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-08_8aebaa49d1ccb37cb2b05d2b3e1f4b43_amadey_coinminer_darkgate_elex_icedid_njrat_redline-stea.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_8aebaa49d1ccb37cb2b05d2b3e1f4b43_amadey_coinminer_darkgate_elex_icedid_njrat_redline-stea.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-08_8aebaa49d1ccb37cb2b05d2b3e1f4b43_amadey_coinminer_darkgate_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 4.6MB
- SHA256 11c35464b154791785d17d8a179aceb10286f1a8875e1a402ffff0ae48705936
- MD5 8aebaa49d1ccb37cb2b05d2b3e1f4b43
- SHA1 5e6d0c6b5f45f2eecf49cda6a07c88a04087c87e
- SHA512 094d4291f48f4d0fe29f9a1de55461f9b98910e9526d9bfce7e0b81a5b55b8bd778ee82d7df2384dcbcf36ccb985b3f38054d96567d5d606945061e2a8aaca24
- SSDEEP 49152:T2aDHXAWSytLoqUCInTUCIabjKoh9WEbtL2tLlZqhaK6zbfqdlIhKPgssSt2gTBn:+stsF7IabjKoh9WyV2Vlx/hv7St0OgPK
- TLSH T128368D217BF48075E1B795B1A9BA8366D9727C604B7086CF6390773E1F32AD05A72323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory