General
- Target 2026-10-26_cbe7b414ab474f0151cddccc346f13f9_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop
- Size 948KB
- Sample261027-hfdtnach45
- SHA256 1e6e4a3b84c27f6b0a68e779ea560b07e39bdae8f1e32215169ca6f5c00143d8
- MD5 cbe7b414ab474f0151cddccc346f13f9
- SHA1 4dc5d81d81b02f167896604cff044af0b354aba2
- SHA512 74713496d20adc46c0d8842f927fce184b0da63e0c468ac933e8284e711851be6f38328128ffa400f605969bdcb9703928d0b1634d80ec3d98d4c9fb6659289c
- SSDEEP 24576:GvO2xJKRI2dOkx2LFAAX1oOYSY82e5QPJJ:GHHKO2FQd1oOU82lPJ
- TLSH T1C5259D16F7A1C072C86742B448B6872EA671BC152B214ACBF7C07B5E4E727D1AE3634D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-10-26_cbe7b414ab474f0151cddccc346f13f9_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-26_cbe7b414ab474f0151cddccc346f13f9_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260911-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-26_cbe7b414ab474f0151cddccc346f13f9_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop
- Size 948KB
- SHA256 1e6e4a3b84c27f6b0a68e779ea560b07e39bdae8f1e32215169ca6f5c00143d8
- MD5 cbe7b414ab474f0151cddccc346f13f9
- SHA1 4dc5d81d81b02f167896604cff044af0b354aba2
- SHA512 74713496d20adc46c0d8842f927fce184b0da63e0c468ac933e8284e711851be6f38328128ffa400f605969bdcb9703928d0b1634d80ec3d98d4c9fb6659289c
- SSDEEP 24576:GvO2xJKRI2dOkx2LFAAX1oOYSY82e5QPJJ:GHHKO2FQd1oOU82lPJ
- TLSH T1C5259D16F7A1C072C86742B448B6872EA671BC152B214ACBF7C07B5E4E727D1AE3634D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with VMProtect.
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory