General
- Target 2026-08-08_ac17b18afc86c708faaa8a3da2077ea4_amadey_coinminer_darkgate_elex_glassworm_graphican_kwampirs_mafia_remcos_rhadamanthys_smoke-loader_stop
- Size 4.8MB
- Sample260809-ae41fs1sas
- SHA256 0fb67d70b29c986dea82f4385b5bbaeb2b8a3725effb09a0d09c740dcd8477a2
- MD5 ac17b18afc86c708faaa8a3da2077ea4
- SHA1 80d79da6c789957f5864584d9a067de7a43c7613
- SHA512 0b3ae16b1c1fc33f3cce9c5160c2864088372a08c5f55f7bb1bf76417cfe2ada4bd1c7ec20dbb670bb747b2f5bb604e03508ffe4d9ea0ba12a6a9175c3396633
- SSDEEP 49152:NHHKO29Ql5QZuTtS0rQMYOQ+q8CEPfTG4Q2TGHQe9KFeMx///x:NnKdmWsM0r1QnIK4PKHd0FeS///x
- TLSH T1AF367D12B780C236D4AA473189AF43AA5778FD114B2687CB7384772E1E736D29F31B19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-08_ac17b18afc86c708faaa8a3da2077ea4_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_ac17b18afc86c708faaa8a3da2077ea4_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-08_ac17b18afc86c708faaa8a3da2077ea4_amadey_coinminer_darkgate_elex_glassworm_graphican_kwampirs_mafia_remcos_rhadamanthys_smoke-loader_stop
- Size 4.8MB
- SHA256 0fb67d70b29c986dea82f4385b5bbaeb2b8a3725effb09a0d09c740dcd8477a2
- MD5 ac17b18afc86c708faaa8a3da2077ea4
- SHA1 80d79da6c789957f5864584d9a067de7a43c7613
- SHA512 0b3ae16b1c1fc33f3cce9c5160c2864088372a08c5f55f7bb1bf76417cfe2ada4bd1c7ec20dbb670bb747b2f5bb604e03508ffe4d9ea0ba12a6a9175c3396633
- SSDEEP 49152:NHHKO29Ql5QZuTtS0rQMYOQ+q8CEPfTG4Q2TGHQe9KFeMx///x:NnKdmWsM0r1QnIK4PKHd0FeS///x
- TLSH T1AF367D12B780C236D4AA473189AF43AA5778FD114B2687CB7384772E1E736D29F31B19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
UPX dump on OEP (original entry point)
Executes dropped EXE
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Drops file in System32 directory