General
- Target 2026-10-01_4da72cb0d9b00dceadaa44a9cebd5aad_amadey_coinminer_elex_hawkeye_remcos_rhadamanthys_smoke-loader
- Size 1.8MB
- Sample261002-sfdtrstw4r
- SHA256 d53f2b31685b6f7d49c6a2259776275686fd81f531266f0a8bc2d13bb4b3834e
- MD5 4da72cb0d9b00dceadaa44a9cebd5aad
- SHA1 200f33322d47a279c073e76188dcd619481ec48a
- SHA512 badd6ed37ef615f1de5a2ff9797610046eb12555e363d2a5728cf1a9238d7a9713db9d036c1d381fd771fe62c72268e70028f8470f1984614119b5dc6a6bb7e5
- SSDEEP 24576:PP6Pz54GXG/MMpxBOkUhMXcBwcCro4lT3E5yZe0p4Ek4niOkl/A04szE87JKTvm:3uzHGv1UasqcVs3EQeW4SkZP4sz9Mb
- TLSH T147955C26F678C333D0B680B6C5D6A769FE3234151B3089CB4349DB2C2E376D69636726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-10-01_4da72cb0d9b00dceadaa44a9cebd5aad_amadey_coinminer_elex_hawkeye_remcos_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_4da72cb0d9b00dceadaa44a9cebd5aad_amadey_coinminer_elex_hawkeye_remcos_rhadamanthys_smoke-loader.exe
Resource
win11ltsc2024-20260911-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-01_4da72cb0d9b00dceadaa44a9cebd5aad_amadey_coinminer_elex_hawkeye_remcos_rhadamanthys_smoke-loader
- Size 1.8MB
- SHA256 d53f2b31685b6f7d49c6a2259776275686fd81f531266f0a8bc2d13bb4b3834e
- MD5 4da72cb0d9b00dceadaa44a9cebd5aad
- SHA1 200f33322d47a279c073e76188dcd619481ec48a
- SHA512 badd6ed37ef615f1de5a2ff9797610046eb12555e363d2a5728cf1a9238d7a9713db9d036c1d381fd771fe62c72268e70028f8470f1984614119b5dc6a6bb7e5
- SSDEEP 24576:PP6Pz54GXG/MMpxBOkUhMXcBwcCro4lT3E5yZe0p4Ek4niOkl/A04szE87JKTvm:3uzHGv1UasqcVs3EQeW4SkZP4sz9Mb
- TLSH T147955C26F678C333D0B680B6C5D6A769FE3234151B3089CB4349DB2C2E376D69636726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory