General
- Target 2026-11-01_c14406b949365322f2e1438292c91bc1_amadey_coinminer_elex_emotet_glassworm_remcos_smoke-loader_stop
- Size 17.0MB
- Sample261102-lp32pagx21
- SHA256 9049607a5ebedaa4d3c2b630915602d1a1e9abb96f9fb5dfc1ab1065843b982e
- MD5 c14406b949365322f2e1438292c91bc1
- SHA1 c46cc42434769a9c8d42298520e76c828eae83c0
- SHA512 f954dfcc4cc3b34078305dee23480e864af92079530f4ff45af1b5d78e6acb215f218ef5505e640438691a81365c3651fe192591c8d473af924cde7a3ee29b20
- SSDEEP 196608:ryd3nfrLZhMWPfkXyzgE7TQ70QfZUfJKs1bqdKoCXLDeopat:m3frLZWWPMXWTY70GZUBKuqdg7Deopw
- TLSH T13907DF23F112D052D0141AF037B5DB3928B066315DBA89D7FFF49EA678B58B2C79260E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-11-01_c14406b949365322f2e1438292c91bc1_amadey_coinminer_elex_emotet_glassworm_remcos_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_c14406b949365322f2e1438292c91bc1_amadey_coinminer_elex_emotet_glassworm_remcos_smoke-loader_stop.exe
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-01_c14406b949365322f2e1438292c91bc1_amadey_coinminer_elex_emotet_glassworm_remcos_smoke-loader_stop
- Size 17.0MB
- SHA256 9049607a5ebedaa4d3c2b630915602d1a1e9abb96f9fb5dfc1ab1065843b982e
- MD5 c14406b949365322f2e1438292c91bc1
- SHA1 c46cc42434769a9c8d42298520e76c828eae83c0
- SHA512 f954dfcc4cc3b34078305dee23480e864af92079530f4ff45af1b5d78e6acb215f218ef5505e640438691a81365c3651fe192591c8d473af924cde7a3ee29b20
- SSDEEP 196608:ryd3nfrLZhMWPfkXyzgE7TQ70QfZUfJKs1bqdKoCXLDeopat:m3frLZWWPMXWTY70GZUBKuqdg7Deopw
- TLSH T13907DF23F112D052D0141AF037B5DB3928B066315DBA89D7FFF49EA678B58B2C79260E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
UPX dump on OEP (original entry point)
-
Suspicious use of NtSetInformationThreadHideFromDebugger