General
- Target 2026-05-06_79f37a4dbbb6422ca21cc88118f15237_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry
- Size 2.0MB
- Sample260506-m8hersgs2y
- SHA256 3be856102a32599f4e8456b67c1a9df6e81682d92cf258bf42c9490811fcf5ae
- MD5 79f37a4dbbb6422ca21cc88118f15237
- SHA1 4019c4deed510e5a46b619d8e8e46bd0a71bf495
- SHA512 288fad2df0a3e673b0935fdd0809e1b4b89dd37ffb0c34b967bd65dabf478b2836caa577e907341e0c12446221c66274237368a9025298997b15153afaf9a33f
- SSDEEP 49152:5ps1n9bTChxKCnFnQXBbrtgb/iQvu0UHOi:5ps1n96hxvWbrtUTrUHOi
- TLSH T12BA5F1037654CC12F68B89321AD53E75383B7D282733CD46AA447B797AF0D9BE691E02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-06_79f37a4dbbb6422ca21cc88118f15237_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260130-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-06_79f37a4dbbb6422ca21cc88118f15237_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win11-20250610-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-06_79f37a4dbbb6422ca21cc88118f15237_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry
- Size 2.0MB
- SHA256 3be856102a32599f4e8456b67c1a9df6e81682d92cf258bf42c9490811fcf5ae
- MD5 79f37a4dbbb6422ca21cc88118f15237
- SHA1 4019c4deed510e5a46b619d8e8e46bd0a71bf495
- SHA512 288fad2df0a3e673b0935fdd0809e1b4b89dd37ffb0c34b967bd65dabf478b2836caa577e907341e0c12446221c66274237368a9025298997b15153afaf9a33f
- SSDEEP 49152:5ps1n9bTChxKCnFnQXBbrtgb/iQvu0UHOi:5ps1n96hxvWbrtUTrUHOi
- TLSH T12BA5F1037654CC12F68B89321AD53E75383B7D282733CD46AA447B797AF0D9BE691E02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Drops file in System32 directory