General
- Target 2026-06-28_ef26205b86627a2e55265a1a4de2be7b_cloudeye_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry
- Size 2.3MB
- Sample260628-wph2maay9v
- SHA256 d64aca73fe080839a54459037833bf57d3eff0d0f3a18ba1aa2e2f82f2f16717
- MD5 ef26205b86627a2e55265a1a4de2be7b
- SHA1 b14880750fb7fef9b3b7f3c66d22058da9938bd4
- SHA512 3e1edaaa9e2aa44b4dc60cc28f139c375298c00618d91fee932b96243769dfad139c613c556e5ddf10ebe8d1d7353bf5c8a2d57af349c5a442a1ad717a3f4840
- SSDEEP 49152:+xa80rQvFh73JbTChxKCnFnQXBbrtgb/iQvu0UHOkZQU:u0sdpJ6hxvWbrtUTrUHOkZr
- TLSH T1B8B5F0152780CD61F36FC07283E5AE79B6B325213732EC966E8851316BF2E6FE381159
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
2026-06-28_ef26205b86627a2e55265a1a4de2be7b_cloudeye_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_ef26205b86627a2e55265a1a4de2be7b_cloudeye_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260618-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-28_ef26205b86627a2e55265a1a4de2be7b_cloudeye_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry
- Size 2.3MB
- SHA256 d64aca73fe080839a54459037833bf57d3eff0d0f3a18ba1aa2e2f82f2f16717
- MD5 ef26205b86627a2e55265a1a4de2be7b
- SHA1 b14880750fb7fef9b3b7f3c66d22058da9938bd4
- SHA512 3e1edaaa9e2aa44b4dc60cc28f139c375298c00618d91fee932b96243769dfad139c613c556e5ddf10ebe8d1d7353bf5c8a2d57af349c5a442a1ad717a3f4840
- SSDEEP 49152:+xa80rQvFh73JbTChxKCnFnQXBbrtgb/iQvu0UHOkZQU:u0sdpJ6hxvWbrtUTrUHOkZr
- TLSH T1B8B5F0152780CD61F36FC07283E5AE79B6B325213732EC966E8851316BF2E6FE381159
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory