General
- Target 2026-08-08_e3dc45ce53b93679c7d3a2928b00d395_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.3MB
- Sample260809-ab2qxsfh67
- SHA256 be5f83b8729cc28e35e487de36111cdba1a07124a86ce3764e7bd43ee7aa72d6
- MD5 e3dc45ce53b93679c7d3a2928b00d395
- SHA1 594324be54d32ed954188852d96e1b3e963b2006
- SHA512 ff4186405fdf120cdb78a7331412af09e1d7aaee3418d5a3b69384437583168de9f62c43b2c2e3e0e9dab8a8305aa3328dd526eba5bc16a252d938aeceb6aa68
- SSDEEP 24576:cvO2xJKRI2FOkx2LFEvcU6UQOJdBqsCPhH9Do2sl:cHHKO29QG56/OJdJCXDrsl
- TLSH T145559E32A6808036E5B3467586FA57BAA5257C215321E1CF73C47A2E1FB37D3A93170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-08_e3dc45ce53b93679c7d3a2928b00d395_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_e3dc45ce53b93679c7d3a2928b00d395_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-08_e3dc45ce53b93679c7d3a2928b00d395_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.3MB
- SHA256 be5f83b8729cc28e35e487de36111cdba1a07124a86ce3764e7bd43ee7aa72d6
- MD5 e3dc45ce53b93679c7d3a2928b00d395
- SHA1 594324be54d32ed954188852d96e1b3e963b2006
- SHA512 ff4186405fdf120cdb78a7331412af09e1d7aaee3418d5a3b69384437583168de9f62c43b2c2e3e0e9dab8a8305aa3328dd526eba5bc16a252d938aeceb6aa68
- SSDEEP 24576:cvO2xJKRI2FOkx2LFEvcU6UQOJdBqsCPhH9Do2sl:cHHKO29QG56/OJdJCXDrsl
- TLSH T145559E32A6808036E5B3467586FA57BAA5257C215321E1CF73C47A2E1FB37D3A93170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detection of CryptoLocker Variants
-
Detection of Cryptolocker Samples
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory