nominatuscrypto | cc6b5b34364300ff2f335a3ec3786179abfe50fc970125e11d15fd6b88cb41aa

General

Target
2026-07-06_0019c20056e9c53bc67f4b9624e1bcf7_amadey_coinminer_elex_glassworm_smoke-loader
Size 4.3MB
Sample260706-2v4s6sat4m
SHA256 cc6b5b34364300ff2f335a3ec3786179abfe50fc970125e11d15fd6b88cb41aa
MD5 0019c20056e9c53bc67f4b9624e1bcf7
SHA1 3368c27ccf91f0a76d3e519810b9a50a40f44a5a
SHA512 1311603d84058d7a3f47eedd724d20a6acf677313517bc809d144e68d63ba21843b5769af2d0fa06dfc5d20ec520ff6f3b64379424134c271a9c505e245d9589
SSDEEP 24576:lKKKKKKKKKKKKKKKKN7ChBWMQ+uSJJd3Dkd9+ZDd3vNSM0y9T+m5k2SzfS4fITST:CjLuSh3i+FtvkMzT+3HfOG+nvtlg
TLSH
T1B426AF927F82C036C09E133608B3D7567132B8669F134AC336E4BB6D6D7A6C05A792F5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-06_0019c20056e9c53bc67f4b9624e1bcf7_amadey_coinminer_elex_glassworm_smoke-loader
- Size 4.3MB
- SHA256 cc6b5b34364300ff2f335a3ec3786179abfe50fc970125e11d15fd6b88cb41aa
- MD5 0019c20056e9c53bc67f4b9624e1bcf7
- SHA1 3368c27ccf91f0a76d3e519810b9a50a40f44a5a
- SHA512 1311603d84058d7a3f47eedd724d20a6acf677313517bc809d144e68d63ba21843b5769af2d0fa06dfc5d20ec520ff6f3b64379424134c271a9c505e245d9589
- SSDEEP 24576:lKKKKKKKKKKKKKKKKN7ChBWMQ+uSJJd3Dkd9+ZDd3vNSM0y9T+m5k2SzfS4fITST:CjLuSh3i+FtvkMzT+3HfOG+nvtlg
- TLSH
  T1B426AF927F82C036C09E133608B3D7567132B8669F134AC336E4BB6D6D7A6C05A792F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery nominatuscrypto ransomware spyware stealer adware persistence
- Detects NominatusCrypto C# variant
- Detects NominatusCrypto DOS executable variant
- Family: NominatusCrypto,NominatusStorm
  NominatusCrypto aka NominatusStorm is a ransomware written in C#.
  ransomware nominatuscrypto
- Detects command variations typically used by ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2