d982b3d9a631b15bd317ca3706b52a5b07480c2b2d926b5f45796d8683022148

General

Target
2026-10-02_6b2af1f13a7dfd14a0b4b0981e7ee572_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_mafia_remcos_smoke-loader_stealc_tofsee
Size 2.6MB
Sample261003-mwlxeswhld
SHA256 d982b3d9a631b15bd317ca3706b52a5b07480c2b2d926b5f45796d8683022148
MD5 6b2af1f13a7dfd14a0b4b0981e7ee572
SHA1 fe1ed48aa466f61cb282f2a032cb57b43c5677e1
SHA512 6d2922b0da5dff768f46b8bbd13735f3e6e215e5f087e7217ab2a6de4d6a7e568e090b0924788bbcc9b0f3bf6c113f6d3b1f3533fc39b0ab6ae8f1d46daf8746
SSDEEP 49152:KTGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:KKkVkOhCXHHFZMjHfUKkVWsM0r1F
TLSH
T169C59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery upx

Malware Config

Targets

- Target
  2026-10-02_6b2af1f13a7dfd14a0b4b0981e7ee572_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_mafia_remcos_smoke-loader_stealc_tofsee
- Size 2.6MB
- SHA256 d982b3d9a631b15bd317ca3706b52a5b07480c2b2d926b5f45796d8683022148
- MD5 6b2af1f13a7dfd14a0b4b0981e7ee572
- SHA1 fe1ed48aa466f61cb282f2a032cb57b43c5677e1
- SHA512 6d2922b0da5dff768f46b8bbd13735f3e6e215e5f087e7217ab2a6de4d6a7e568e090b0924788bbcc9b0f3bf6c113f6d3b1f3533fc39b0ab6ae8f1d46daf8746
- SSDEEP 49152:KTGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:KKkVkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH
  T169C59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery upx
- Detection of CryptoLocker Variants
- Detection of Cryptolocker Samples
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detection of CryptoLocker Variants

Detection of Cryptolocker Samples

UPX dump on OEP (original entry point)

Executes dropped EXE

Unexpected DNS network traffic destination

Drops file in System32 directory

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2