General
- Target 2026-08-23_41b2ba352e00b7b2a9b63e611c4c8853_amadey_coinminer_elex_glassworm_kwampirs_mafia_remcos_smoke-loader
- Size 1024KB
- Sample260824-qedfhatxdz
- SHA256 c772bdaa126576a7a02f0a286ea51aa87657e9a2c2e60fe55ef4a8d73c35d3db
- MD5 41b2ba352e00b7b2a9b63e611c4c8853
- SHA1 98df24fce9c401f9885e0e65a31ff0b1068d262f
- SHA512 a3d99b3ddf715eef18eed9b7eac2c7ee4ab12bac7c30131df241c9a03b7933099d5f5e0127b289347ec76b39467694a2ff1d33b5ba0f4f56fcd4796dfae9af09
- SSDEEP 24576:6jHPOSOkx2LFscUQPxuZ98Es8k3OH3C0rQ6+y:6TGkQy5QZuTtS0rQi
- TLSH T1E2259E31E242C03AD5A70172C6BE4BAF95687D25432961C7A3D43D762FB62D2AA3170F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-23_41b2ba352e00b7b2a9b63e611c4c8853_amadey_coinminer_elex_glassworm_kwampirs_mafia_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-23_41b2ba352e00b7b2a9b63e611c4c8853_amadey_coinminer_elex_glassworm_kwampirs_mafia_remcos_smoke-loader
- Size 1024KB
- SHA256 c772bdaa126576a7a02f0a286ea51aa87657e9a2c2e60fe55ef4a8d73c35d3db
- MD5 41b2ba352e00b7b2a9b63e611c4c8853
- SHA1 98df24fce9c401f9885e0e65a31ff0b1068d262f
- SHA512 a3d99b3ddf715eef18eed9b7eac2c7ee4ab12bac7c30131df241c9a03b7933099d5f5e0127b289347ec76b39467694a2ff1d33b5ba0f4f56fcd4796dfae9af09
- SSDEEP 24576:6jHPOSOkx2LFscUQPxuZ98Es8k3OH3C0rQ6+y:6TGkQy5QZuTtS0rQi
- TLSH T1E2259E31E242C03AD5A70172C6BE4BAF95687D25432961C7A3D43D762FB62D2AA3170F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory