e97649f81f39e4644ffd9312771a6c3b41b8c91d6544398d4b5e4a698f320acf

General

Target
2026-08-30_d1193690c016160dbec34598c9e32459_amadey_coinminer_elex_matanbuchus_smoke-loader
Size 2.0MB
Sample260831-ejl3naee89
SHA256 e97649f81f39e4644ffd9312771a6c3b41b8c91d6544398d4b5e4a698f320acf
MD5 d1193690c016160dbec34598c9e32459
SHA1 e5b8ca1ad55dbc1ef2088b05d1042f5a3f4e3c21
SHA512 ed944ed4c85af84d07168df8326933022d2d82653c97d418cac48e389569e87eadefa9584b76d0a309ece4b6ccd98ad52edb4847626f1b2318212a2a900f50d6
SSDEEP 49152:T68jG6jD1a5irh1NKN7swFM8t4ddoFy44SS7pb:u8CegQ7WOQorrSSNb
TLSH
T167A52312B2648272E2E361765A26D7205F3FBE24AB10428A73447E1F3D755C1BBF6783
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-30_d1193690c016160dbec34598c9e32459_amadey_coinminer_elex_matanbuchus_smoke-loader
- Size 2.0MB
- SHA256 e97649f81f39e4644ffd9312771a6c3b41b8c91d6544398d4b5e4a698f320acf
- MD5 d1193690c016160dbec34598c9e32459
- SHA1 e5b8ca1ad55dbc1ef2088b05d1042f5a3f4e3c21
- SHA512 ed944ed4c85af84d07168df8326933022d2d82653c97d418cac48e389569e87eadefa9584b76d0a309ece4b6ccd98ad52edb4847626f1b2318212a2a900f50d6
- SSDEEP 49152:T68jG6jD1a5irh1NKN7swFM8t4ddoFy44SS7pb:u8CegQ7WOQorrSSNb
- TLSH
  T167A52312B2648272E2E361765A26D7205F3FBE24AB10428A73447E1F3D755C1BBF6783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery persistence privilege_escalation ransomware upx
- UPX dump on OEP (original entry point)
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2