General
- Target 2026-08-19_53d1dd678d95444eb33e7df25d21820e_amadey_coinminer_darkgate_elex_glassworm_graphican_kwampirs_mafia_remcos_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- Sample260819-nrd7fsef76
- SHA256 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655
- MD5 53d1dd678d95444eb33e7df25d21820e
- SHA1 0c571131ec9958b6fd1269b4772d1b7903552320
- SHA512 4dd522a9096ccfec58f8a977b9016e16f1041c30155b4072e13b1559bc68147c3727054d434aa92d9a4819cc249b222b1836598d26fbfced4410f3c538ad7fcf
- SSDEEP 24576:1vO2xJKRI2FOkx2LFEWcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAI:1HHKO29Qr5QZuTtS0rQMYOQ+q8CEI
- TLSH T174858E21B351C036D4AB05758ABA47AE9578BC310B2551C7B3C47B7E6FB22D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_53d1dd678d95444eb33e7df25d21820e_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_53d1dd678d95444eb33e7df25d21820e_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_53d1dd678d95444eb33e7df25d21820e_amadey_coinminer_darkgate_elex_glassworm_graphican_kwampirs_mafia_remcos_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- SHA256 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655
- MD5 53d1dd678d95444eb33e7df25d21820e
- SHA1 0c571131ec9958b6fd1269b4772d1b7903552320
- SHA512 4dd522a9096ccfec58f8a977b9016e16f1041c30155b4072e13b1559bc68147c3727054d434aa92d9a4819cc249b222b1836598d26fbfced4410f3c538ad7fcf
- SSDEEP 24576:1vO2xJKRI2FOkx2LFEWcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAI:1HHKO29Qr5QZuTtS0rQMYOQ+q8CEI
- TLSH T174858E21B351C036D4AB05758ABA47AE9578BC310B2551C7B3C47B7E6FB22D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory