General
- Target 2026-08-18_32574c04d04e9ffd5c8422b71514f8a2_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop
- Size 1.7MB
- Sample260818-kce9esygnc
- SHA256 c7e78c34da4a94d9f574c4479ad60c3de6eafa3d792f4999e323d2b46d32f283
- MD5 32574c04d04e9ffd5c8422b71514f8a2
- SHA1 ec3102689460509a4e4e99adf23be90c588f7968
- SHA512 b66c5d09dbbfe629c6c83c081782330e7ff4b10c142a81896ac7dbda162fd60fafa861725ba192d4d57d919108e1801b015cbff2964d0e197cd96d84e53d5436
- SSDEEP 24576:0vO2xJKRh2kOkx2LFxNcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbA0I:0HHKX2WQt5QZuTtS0rQMYOQ+q8CE0I
- TLSH T14E859E21B791C036D4AB01758AB98BAEA578BD31072551C7B3C47A7E5FB12D2AE3130F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-18_32574c04d04e9ffd5c8422b71514f8a2_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-18_32574c04d04e9ffd5c8422b71514f8a2_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop
- Size 1.7MB
- SHA256 c7e78c34da4a94d9f574c4479ad60c3de6eafa3d792f4999e323d2b46d32f283
- MD5 32574c04d04e9ffd5c8422b71514f8a2
- SHA1 ec3102689460509a4e4e99adf23be90c588f7968
- SHA512 b66c5d09dbbfe629c6c83c081782330e7ff4b10c142a81896ac7dbda162fd60fafa861725ba192d4d57d919108e1801b015cbff2964d0e197cd96d84e53d5436
- SSDEEP 24576:0vO2xJKRh2kOkx2LFxNcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbA0I:0HHKX2WQt5QZuTtS0rQMYOQ+q8CE0I
- TLSH T14E859E21B791C036D4AB01758AB98BAEA578BD31072551C7B3C47A7E5FB12D2AE3130F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory