General
- Target 2026-07-11_a400b7a5de0432f52ca5794b5bf1919c_amadey_coinminer_elex_glassworm_njrat_smoke-loader_wannacry
- Size 6.2MB
- Sample260711-py2f1acv9w
- SHA256 429d7cff1414bcf97c166481444d12e943dc3efbbf589cc3ac07ca6614c2eb78
- MD5 a400b7a5de0432f52ca5794b5bf1919c
- SHA1 0ab321c3a2ff056f421c2b09f7507ebdb488eafd
- SHA512 e8cdd1ea253c4d2d5c996654725c2c7324154f8370beda97e7755eba5f261fbb49e436f96ac77fb2796c6870067a518c5de0931f3886093d98c8c775f01e89ef
- SSDEEP 98304:H8iifszJwjI5klUigKYkBEvHPILz1p/kjRm4OWL22ImljBV+:K5bUpMBF1p/kjRm4OWi2ba
- TLSH T1536612067BE18038F5F356B598BEA268547E79F11B34C0C752C027EC5A75AE2AD31B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-11_a400b7a5de0432f52ca5794b5bf1919c_amadey_coinminer_elex_glassworm_njrat_smoke-loader_wannacry.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-11_a400b7a5de0432f52ca5794b5bf1919c_amadey_coinminer_elex_glassworm_njrat_smoke-loader_wannacry.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
downloader_req.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
downloader_req.pyc
Resource
win11ltsc2024-20260710-en
Malware Config
Targets
-
- Target 2026-07-11_a400b7a5de0432f52ca5794b5bf1919c_amadey_coinminer_elex_glassworm_njrat_smoke-loader_wannacry
- Size 6.2MB
- SHA256 429d7cff1414bcf97c166481444d12e943dc3efbbf589cc3ac07ca6614c2eb78
- MD5 a400b7a5de0432f52ca5794b5bf1919c
- SHA1 0ab321c3a2ff056f421c2b09f7507ebdb488eafd
- SHA512 e8cdd1ea253c4d2d5c996654725c2c7324154f8370beda97e7755eba5f261fbb49e436f96ac77fb2796c6870067a518c5de0931f3886093d98c8c775f01e89ef
- SSDEEP 98304:H8iifszJwjI5klUigKYkBEvHPILz1p/kjRm4OWL22ImljBV+:K5bUpMBF1p/kjRm4OWi2ba
- TLSH T1536612067BE18038F5F356B598BEA268547E79F11B34C0C752C027EC5A75AE2AD31B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Disables RegEdit via registry modification
-
Event Triggered Execution: Image File Execution Options Injection
-
Adds Run key to start application
-
Modifies WinLogon
-
Drops file in System32 directory
-
- Target downloader_req.pyc
- Size 16B
- SHA256 afe92b8020dc0bcc44af7318d12c3442d72c340da2ae7ad7e15849f79baf1183
- MD5 bf66239df14fc44474297874d7951392
- SHA1 4607e769316d54e191940a325169c024778e5104
- SHA512 e5712a748ee91d1140fb23db8033a672e5f21ed278f2aaa8158f4f2b6ad23b90c1c7e2b8c377dccca8ac3b74259f7a09cbaff747be27da49407464327f8d5c28
- MD5 SHA1 SHA512
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
1Clear Persistence
1Modify Registry
3