nominatuscrypto | 197348485deb50a0eaf621074156ea2ca89b35ee57778e166b651e1012c7a9e4

General

Target
2026-07-06_569832bcbdbaa2f46f1d96a75f29c2c4_amadey_coinminer_elex_glassworm_smoke-loader
Size 7.9MB
Sample260707-d95f9ahs2w
SHA256 197348485deb50a0eaf621074156ea2ca89b35ee57778e166b651e1012c7a9e4
MD5 569832bcbdbaa2f46f1d96a75f29c2c4
SHA1 75a8c8998be89e9c0a946121ec6ea5691f44e6c3
SHA512 ddc4e297781a876ce23d6f99e3fc1753a0afd10e4339c63cbb8aae914c822bde658e606e9e6433dd9198072b6bdcfc6a89f3cb51a0d65cb7eab72650062c608a
SSDEEP 24576:lKKKKKKKKKKKKKKKKKKKKKN7ChBWMQ+uSJJd3Dkd9+ZDd3vNSM0y9T+m5k2SzfS8:xjLuSh3i+FtvkMzT+3HfOG
TLSH
T110869E967B82C035C05E133648A3C7577232B8669F134AD336E4BB2D7DBA6C05A762F4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-06_569832bcbdbaa2f46f1d96a75f29c2c4_amadey_coinminer_elex_glassworm_smoke-loader
- Size 7.9MB
- SHA256 197348485deb50a0eaf621074156ea2ca89b35ee57778e166b651e1012c7a9e4
- MD5 569832bcbdbaa2f46f1d96a75f29c2c4
- SHA1 75a8c8998be89e9c0a946121ec6ea5691f44e6c3
- SHA512 ddc4e297781a876ce23d6f99e3fc1753a0afd10e4339c63cbb8aae914c822bde658e606e9e6433dd9198072b6bdcfc6a89f3cb51a0d65cb7eab72650062c608a
- SSDEEP 24576:lKKKKKKKKKKKKKKKKKKKKKN7ChBWMQ+uSJJd3Dkd9+ZDd3vNSM0y9T+m5k2SzfS8:xjLuSh3i+FtvkMzT+3HfOG
- TLSH
  T110869E967B82C035C05E133648A3C7577232B8669F134AD336E4BB2D7DBA6C05A762F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery nominatuscrypto ransomware spyware stealer adware persistence
- Detects NominatusCrypto C# variant
- Detects NominatusCrypto DOS executable variant
- Family: NominatusCrypto,NominatusStorm
  NominatusCrypto aka NominatusStorm is a ransomware written in C#.
  ransomware nominatuscrypto
- Detects command variations typically used by ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2