General
- Target 2026-11-10_9c4cc1585e87411aaa1febc7f9ededd9_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 871KB
- Sample261110-gv4sysdc85
- SHA256 9b96c5793a32fbd3a2137d0f8a70e5b8e616e2a08b952419539a2879b2f4dae7
- MD5 9c4cc1585e87411aaa1febc7f9ededd9
- SHA1 f0534cda3823189580b008aabea011c6418ea698
- SHA512 635a3d09a07fb533e20dfd648e7d7dd4b620b737c53e5830674c9f43331854c5f0cfc859ef3741760d060e2ae493d1c4110566e3e65a5e2253b8e57179109adb
- SSDEEP 12288:JSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikGU5rCOTeidT:wvO2xJKRI2FOkx2LFEvcU6UQOJdT
- TLSH T185156B31E681C036D5B34571C6FA4BBBA9647D21531165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-11-10_9c4cc1585e87411aaa1febc7f9ededd9_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-10_9c4cc1585e87411aaa1febc7f9ededd9_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win11ltsc2024-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-10_9c4cc1585e87411aaa1febc7f9ededd9_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 871KB
- SHA256 9b96c5793a32fbd3a2137d0f8a70e5b8e616e2a08b952419539a2879b2f4dae7
- MD5 9c4cc1585e87411aaa1febc7f9ededd9
- SHA1 f0534cda3823189580b008aabea011c6418ea698
- SHA512 635a3d09a07fb533e20dfd648e7d7dd4b620b737c53e5830674c9f43331854c5f0cfc859ef3741760d060e2ae493d1c4110566e3e65a5e2253b8e57179109adb
- SSDEEP 12288:JSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikGU5rCOTeidT:wvO2xJKRI2FOkx2LFEvcU6UQOJdT
- TLSH T185156B31E681C036D5B34571C6FA4BBBA9647D21531165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detection of CryptoLocker Variants
- Custom signature
Detection of Cryptolocker Samples
Executes dropped EXE
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Drops file in System32 directory