General
- Target 2026-10-11_3dee5076b878e694b6ef834347be5f1a_amadey_coinminer_elex_glassworm_njrat_smoke-loader_stop
- Size 3.0MB
- Sample261012-3rx2wsfe38
- SHA256 fc23f7e69715e370bfbf6abda186439a9257c0f33995731a68d70b9c7ad3e43e
- MD5 3dee5076b878e694b6ef834347be5f1a
- SHA1 a1db13f1e6b8b6463667a0ce0b0be51e15266ea6
- SHA512 16fcd3c1f5e1646b1d2a2ed0ae3fa1ccbb950a8b2b0b07c68289258ad931ad2213b10675dbe901feddc52825489c067187fed42ce2043453e7b27e1318021dd0
- SSDEEP 49152:aA/JuTQKqVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/:l/whnLrHp/qKm2/Sb/
- TLSH T1F8E55953EB914AE8E39D0536DF544150E72AF2256BEF13A27428420DDE83387BF61A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-11_3dee5076b878e694b6ef834347be5f1a_amadey_coinminer_elex_glassworm_njrat_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-11_3dee5076b878e694b6ef834347be5f1a_amadey_coinminer_elex_glassworm_njrat_smoke-loader_stop.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-11_3dee5076b878e694b6ef834347be5f1a_amadey_coinminer_elex_glassworm_njrat_smoke-loader_stop
- Size 3.0MB
- SHA256 fc23f7e69715e370bfbf6abda186439a9257c0f33995731a68d70b9c7ad3e43e
- MD5 3dee5076b878e694b6ef834347be5f1a
- SHA1 a1db13f1e6b8b6463667a0ce0b0be51e15266ea6
- SHA512 16fcd3c1f5e1646b1d2a2ed0ae3fa1ccbb950a8b2b0b07c68289258ad931ad2213b10675dbe901feddc52825489c067187fed42ce2043453e7b27e1318021dd0
- SSDEEP 49152:aA/JuTQKqVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/:l/whnLrHp/qKm2/Sb/
- TLSH T1F8E55953EB914AE8E39D0536DF544150E72AF2256BEF13A27428420DDE83387BF61A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory