General
- Target 2026-07-09_5164ca8439e4fe0e9ecf2e08c0e52b51_coinminer_darpapox_elex_nymaim_remcos_rhadamanthys_wannacry
- Size 2.2MB
- Sample260709-v3eexsew9r
- SHA256 e21b89b7d7beee31cb1a76e31328ffc3b926b1cec799edd1251ab0933d20f144
- MD5 5164ca8439e4fe0e9ecf2e08c0e52b51
- SHA1 d9acafb4fe8042c12b1e95bab266c70eb8d1ff7b
- SHA512 a153f6edaadce6871a0fa1af280cbf323fcd114499322462ccea5ab58b66607abf2358c9fb206730ca3df90caeb02a6689e1e38c1f9a50e26e6e0369dbc2d188
- SSDEEP 49152:RZYetUNs1bTChxKCnFnQXBbrtgb/iQvu0UHOy:jYetUNs16hxvWbrtUTrUHOy
- TLSH T111B5F1027791C8B1E74F81720AE6AF39757359912B33CEC76B88D9342BB29D6E372015
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_5164ca8439e4fe0e9ecf2e08c0e52b51_coinminer_darpapox_elex_nymaim_remcos_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_5164ca8439e4fe0e9ecf2e08c0e52b51_coinminer_darpapox_elex_nymaim_remcos_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260706-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_5164ca8439e4fe0e9ecf2e08c0e52b51_coinminer_darpapox_elex_nymaim_remcos_rhadamanthys_wannacry
- Size 2.2MB
- SHA256 e21b89b7d7beee31cb1a76e31328ffc3b926b1cec799edd1251ab0933d20f144
- MD5 5164ca8439e4fe0e9ecf2e08c0e52b51
- SHA1 d9acafb4fe8042c12b1e95bab266c70eb8d1ff7b
- SHA512 a153f6edaadce6871a0fa1af280cbf323fcd114499322462ccea5ab58b66607abf2358c9fb206730ca3df90caeb02a6689e1e38c1f9a50e26e6e0369dbc2d188
- SSDEEP 49152:RZYetUNs1bTChxKCnFnQXBbrtgb/iQvu0UHOy:jYetUNs16hxvWbrtUTrUHOy
- TLSH T111B5F1027791C8B1E74F81720AE6AF39757359912B33CEC76B88D9342BB29D6E372015
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory