General
- Target 2026-07-12_8e77d0ad237f6bea4fa6efff14cf648a_coinminer_darpapox_elex_nymaim_redline-stealer_rhadamanthys_wannacry
- Size 2.8MB
- Sample260712-t5ctfadt7p
- SHA256 b1cf98675a9b036674d8a9255181f0d5e7db26628b64653ed83b7575817378b9
- MD5 8e77d0ad237f6bea4fa6efff14cf648a
- SHA1 2e182ea3844b44e1229c20b539612095f0779472
- SHA512 544591a519c4bcb7e2314f0a12a9cd1e919cb16dae40a83f9b5d1ffaed17ced5276d4e7ca02e436e3e1d39b47d324217f8d9b835d1214b480fe96ec0bc4fb6ef
- SSDEEP 49152:GzqsFZ7/OiZLHkJE/Z2NbTChxKCnFnQXBbrtgb/iQvu0UHOaJ:nkd/FDrUN6hxvWbrtUTrUHO4
- TLSH T138D5F1123780CD71F3ABC17246E95F7172B7AC306732C917BA84B63A1AF2997D791602
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_8e77d0ad237f6bea4fa6efff14cf648a_coinminer_darpapox_elex_nymaim_redline-stealer_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_8e77d0ad237f6bea4fa6efff14cf648a_coinminer_darpapox_elex_nymaim_redline-stealer_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-12_8e77d0ad237f6bea4fa6efff14cf648a_coinminer_darpapox_elex_nymaim_redline-stealer_rhadamanthys_wannacry
- Size 2.8MB
- SHA256 b1cf98675a9b036674d8a9255181f0d5e7db26628b64653ed83b7575817378b9
- MD5 8e77d0ad237f6bea4fa6efff14cf648a
- SHA1 2e182ea3844b44e1229c20b539612095f0779472
- SHA512 544591a519c4bcb7e2314f0a12a9cd1e919cb16dae40a83f9b5d1ffaed17ced5276d4e7ca02e436e3e1d39b47d324217f8d9b835d1214b480fe96ec0bc4fb6ef
- SSDEEP 49152:GzqsFZ7/OiZLHkJE/Z2NbTChxKCnFnQXBbrtgb/iQvu0UHOaJ:nkd/FDrUN6hxvWbrtUTrUHO4
- TLSH T138D5F1123780CD71F3ABC17246E95F7172B7AC306732C917BA84B63A1AF2997D791602
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory