c8b3945b70e4ece7bd1008e0b69c8be457462800463bfdc22b934326b78fec4f

General

Target
2026-09-24_1450257f15d84eda02d00ccebb1b5cf8_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz
Size 6.2MB
Sample260925-rxvceatzfs
SHA256 c8b3945b70e4ece7bd1008e0b69c8be457462800463bfdc22b934326b78fec4f
MD5 1450257f15d84eda02d00ccebb1b5cf8
SHA1 fd13a9cc06515c1d411bc4e501020695d8c65459
SHA512 304fa3f36a0cfaa142df7666bd84c415bbb5fcb0fd6e0414ecca743ea5481910f467c99d8aadc7ccd99733d99ea21a50051ca494269d3155973fba8c4d9c6bd6
SSDEEP 98304:jENvTDb+mpiXDA6qKZMuUDXoqvvVgw6ErH:QNr3VpiTA6qnDzVw
TLSH
T1D1669D73B6C5F07FE1EFC170482AD22996B6BD784530859BBF8879197AF0681913A313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-24_1450257f15d84eda02d00ccebb1b5cf8_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz
- Size 6.2MB
- SHA256 c8b3945b70e4ece7bd1008e0b69c8be457462800463bfdc22b934326b78fec4f
- MD5 1450257f15d84eda02d00ccebb1b5cf8
- SHA1 fd13a9cc06515c1d411bc4e501020695d8c65459
- SHA512 304fa3f36a0cfaa142df7666bd84c415bbb5fcb0fd6e0414ecca743ea5481910f467c99d8aadc7ccd99733d99ea21a50051ca494269d3155973fba8c4d9c6bd6
- SSDEEP 98304:jENvTDb+mpiXDA6qKZMuUDXoqvvVgw6ErH:QNr3VpiTA6qnDzVw
- TLSH
  T1D1669D73B6C5F07FE1EFC170482AD22996B6BD784530859BBF8879197AF0681913A313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution upx
- Detects JavaScript files used for persistence and executable or script execution
- UPX dump on OEP (original entry point)
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2