General
- Target 2026-08-23_41f4335ec413c67f0437389c91524513_amadey_coinminer_cryptolocker_elex_graphican_rhadamanthys_smoke-loader_stop
- Size 743KB
- Sample260824-qdstsstxcy
- SHA256 7a3a95850f35ad5d3d597c8084eb1b7e40e1c9df7b2a2eec13a335799bfc5da8
- MD5 41f4335ec413c67f0437389c91524513
- SHA1 6e331478c80cd42516922ffa7849fab8c2ff092b
- SHA512 b241af58e4fd319f82a263082d8cc5d339d3a23b88f97b7cc6b7e8cbe764d9ce649ba4c4db0721ff7435cd02962f1df90f34fe5c5894bb8155a08769221b8a93
- SSDEEP 12288:ZSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikG8:gvO2xJKRI2FOkx2LFEvcU68
- TLSH T125F45A31E2418036D5B34576C6FA0BBFB5647D25131165CBA3C8BA262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-23_41f4335ec413c67f0437389c91524513_amadey_coinminer_cryptolocker_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_41f4335ec413c67f0437389c91524513_amadey_coinminer_cryptolocker_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-23_41f4335ec413c67f0437389c91524513_amadey_coinminer_cryptolocker_elex_graphican_rhadamanthys_smoke-loader_stop
- Size 743KB
- SHA256 7a3a95850f35ad5d3d597c8084eb1b7e40e1c9df7b2a2eec13a335799bfc5da8
- MD5 41f4335ec413c67f0437389c91524513
- SHA1 6e331478c80cd42516922ffa7849fab8c2ff092b
- SHA512 b241af58e4fd319f82a263082d8cc5d339d3a23b88f97b7cc6b7e8cbe764d9ce649ba4c4db0721ff7435cd02962f1df90f34fe5c5894bb8155a08769221b8a93
- SSDEEP 12288:ZSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikG8:gvO2xJKRI2FOkx2LFEvcU68
- TLSH T125F45A31E2418036D5B34576C6FA0BBFB5647D25131165CBA3C8BA262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detection of CryptoLocker Variants
- Custom signature
Detection of Cryptolocker Samples
Executes dropped EXE
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Drops file in System32 directory