General
- Target 2026-06-27_18444f2c9ce5e15e55712e1f0f45ebb4_coinminer_darpapox_elex_glassworm_nymaim_rhadamanthys_wannacry
- Size 2.1MB
- Sample260629-lncs4sh18s
- SHA256 cb98ca36a113f03724edcf9c1185dc6a05125687e88442db6cf9f28b4f0f4278
- MD5 18444f2c9ce5e15e55712e1f0f45ebb4
- SHA1 fed1ce21b5a7611e430ad3eb448771b6f2804392
- SHA512 12a244750fbc69bd3a9cf7c6a23807ecccc90181acc65aa262fcd7f87f761de723dd951eee1f34bb3475e0090bd04da1164ca0a3f822e4de308f3f9fb33339cb
- SSDEEP 49152:qkoaTCxbTChxKCnFnQXBbrtgb/iQvu0UHOaL:72x6hxvWbrtUTrUHOa
- TLSH T152A5CF107344CC67F31F947A4AED99303573AD206376E84D2956323A16F2B1B92EEA1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_18444f2c9ce5e15e55712e1f0f45ebb4_coinminer_darpapox_elex_glassworm_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_18444f2c9ce5e15e55712e1f0f45ebb4_coinminer_darpapox_elex_glassworm_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260618-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-27_18444f2c9ce5e15e55712e1f0f45ebb4_coinminer_darpapox_elex_glassworm_nymaim_rhadamanthys_wannacry
- Size 2.1MB
- SHA256 cb98ca36a113f03724edcf9c1185dc6a05125687e88442db6cf9f28b4f0f4278
- MD5 18444f2c9ce5e15e55712e1f0f45ebb4
- SHA1 fed1ce21b5a7611e430ad3eb448771b6f2804392
- SHA512 12a244750fbc69bd3a9cf7c6a23807ecccc90181acc65aa262fcd7f87f761de723dd951eee1f34bb3475e0090bd04da1164ca0a3f822e4de308f3f9fb33339cb
- SSDEEP 49152:qkoaTCxbTChxKCnFnQXBbrtgb/iQvu0UHOaL:72x6hxvWbrtUTrUHOa
- TLSH T152A5CF107344CC67F31F947A4AED99303573AD206376E84D2956323A16F2B1B92EEA1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory