General
- Target 2026-07-05_e6dbac74883690625dbb6da2577037d1_amadey_coinminer_darpapox_elex_jaku_nymaim_remcos_rhadamanthys_stealc_stop_wannacry
- Size 2.1MB
- Sample260705-s7ekdadt5w
- SHA256 afc479070195d052bdcd8e100da0f7f803b2dbb323bc446aa5e740980cfea21e
- MD5 e6dbac74883690625dbb6da2577037d1
- SHA1 6fbb47b9b494f4f8157d6fc59859ca7837361e72
- SHA512 0b8c6db4c9c9a75f5568ca87d7d01f18c06fa122b7c870ca55879436d85d07ed7be06a916d79cce1a84b63b14fd7a6ea5fee91e8e2af77c5304358c5c9927aa9
- SSDEEP 49152:8e5/xbTChxKCnFnQXBbrtgb/iQvu0UHO1:8e5/x6hxvWbrtUTrUHO1
- TLSH T102A5F0156B90CC70E36FC53283D66F76B63726603732E987AB8415342FB0AABE7B1145
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-05_e6dbac74883690625dbb6da2577037d1_amadey_coinminer_darpapox_elex_jaku_nymaim_remcos_rhadam.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_e6dbac74883690625dbb6da2577037d1_amadey_coinminer_darpapox_elex_jaku_nymaim_remcos_rhadam.exe
Resource
win11ltsc2024-20260629-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-05_e6dbac74883690625dbb6da2577037d1_amadey_coinminer_darpapox_elex_jaku_nymaim_remcos_rhadamanthys_stealc_stop_wannacry
- Size 2.1MB
- SHA256 afc479070195d052bdcd8e100da0f7f803b2dbb323bc446aa5e740980cfea21e
- MD5 e6dbac74883690625dbb6da2577037d1
- SHA1 6fbb47b9b494f4f8157d6fc59859ca7837361e72
- SHA512 0b8c6db4c9c9a75f5568ca87d7d01f18c06fa122b7c870ca55879436d85d07ed7be06a916d79cce1a84b63b14fd7a6ea5fee91e8e2af77c5304358c5c9927aa9
- SSDEEP 49152:8e5/xbTChxKCnFnQXBbrtgb/iQvu0UHO1:8e5/x6hxvWbrtUTrUHO1
- TLSH T102A5F0156B90CC70E36FC53283D66F76B63726603732E987AB8415342FB0AABE7B1145
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory