General
- Target 2026-08-10_f2d439cdcd4d74155289626e33c7a450_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee
- Size 1.1MB
- Sample260810-3chnna1cqf
- SHA256 93a1daf6f2bcc19f40b221a1f58a3d500eae6ea682e1538d9579784c77782616
- MD5 f2d439cdcd4d74155289626e33c7a450
- SHA1 ba629584cab30f8c8df74bc5e516b83cd46d20c2
- SHA512 0fb0ed4b164955cca77c7f9bd48941e5ad3791e85c747f848527f0a96d50e86e8c7ef00dab42e5a8ca416e690d8635499304c5c33206861f08de282edc6e8f48
- SSDEEP 12288:vSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidzN/VTg:avO2xJKRw2kOkx2LFRvcU6UQOJdM
- TLSH T1F5357C31A681C036D5B34571C6FA4BBBA9747D25131165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-10_f2d439cdcd4d74155289626e33c7a450_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_f2d439cdcd4d74155289626e33c7a450_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee
- Size 1.1MB
- SHA256 93a1daf6f2bcc19f40b221a1f58a3d500eae6ea682e1538d9579784c77782616
- MD5 f2d439cdcd4d74155289626e33c7a450
- SHA1 ba629584cab30f8c8df74bc5e516b83cd46d20c2
- SHA512 0fb0ed4b164955cca77c7f9bd48941e5ad3791e85c747f848527f0a96d50e86e8c7ef00dab42e5a8ca416e690d8635499304c5c33206861f08de282edc6e8f48
- SSDEEP 12288:vSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidzN/VTg:avO2xJKRw2kOkx2LFRvcU6UQOJdM
- TLSH T1F5357C31A681C036D5B34571C6FA4BBBA9747D25131165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detection of CryptoLocker Variants
-
Detection of Cryptolocker Samples
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory