General
- Target 2026-09-06_8c0ad3d645c5b08cd2d3972a5e89884a_amadey_coinminer_darkgate_elex_glassworm_graphican_kwampirs_mafia_remcos_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- Sample260906-2y4btathmb
- SHA256 a654d8b4d61a4b729de50d3338bdd0e341852fa626897b4b2d824bfde0fe9a5c
- MD5 8c0ad3d645c5b08cd2d3972a5e89884a
- SHA1 f6207c6307cb52f8940f5db2835626d2b97cf53e
- SHA512 bd0edc72bc137c4f2046d82d919b5f237a96511dd8da779456fdbfc525e12684836c62f3352a2a7b6896b3199906525ba69ce4296d072c940aa00026f897f248
- SSDEEP 24576:JvO2xJKRI2FOkx2LFEWcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAI:JHHKO29Qr5QZuTtS0rQMYOQ+q8CEI
- TLSH T131858E21B351C036D4AB05758ABA47AE9578BC310B2551C7B3C47B7E6FB22D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-06_8c0ad3d645c5b08cd2d3972a5e89884a_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-06_8c0ad3d645c5b08cd2d3972a5e89884a_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-06_8c0ad3d645c5b08cd2d3972a5e89884a_amadey_coinminer_darkgate_elex_glassworm_graphican_kwampirs_mafia_remcos_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- SHA256 a654d8b4d61a4b729de50d3338bdd0e341852fa626897b4b2d824bfde0fe9a5c
- MD5 8c0ad3d645c5b08cd2d3972a5e89884a
- SHA1 f6207c6307cb52f8940f5db2835626d2b97cf53e
- SHA512 bd0edc72bc137c4f2046d82d919b5f237a96511dd8da779456fdbfc525e12684836c62f3352a2a7b6896b3199906525ba69ce4296d072c940aa00026f897f248
- SSDEEP 24576:JvO2xJKRI2FOkx2LFEWcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAI:JHHKO29Qr5QZuTtS0rQMYOQ+q8CEI
- TLSH T131858E21B351C036D4AB05758ABA47AE9578BC310B2551C7B3C47B7E6FB22D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory