General
- Target 2026-07-12_470072ee0c9338e07f23966a391855ae_amadey_coinminer_darpapox_elex_manuscrypt_nymaim_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 2.2MB
- Sample260712-vtwylses4n
- SHA256 b7806c139edd53f37625c0faa8ed8e487aed63100792a008302e2d9b287337e6
- MD5 470072ee0c9338e07f23966a391855ae
- SHA1 a72f4f1d90b15eb07e704fcd72b71d7c4075ca0c
- SHA512 71778111144212bd0b6c38c09e1111453c7d7dac9c8ccd50c01d820a04f66e0857407bdfc8f959a851b4c520a37dc12c4776f9da477cb68b51f160010439d833
- SSDEEP 49152:+IjkgLmmpbTChxKCnFnQXBbrtgb/iQvu0UHOa+:DjkgLRp6hxvWbrtUTrUHOT
- TLSH T167B5EF013750CC61F65FC03242E59F757673AC213B33DA826A84767A1FF2A9BDB91286
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_470072ee0c9338e07f23966a391855ae_amadey_coinminer_darpapox_elex_manuscrypt_nymaim_rhadama.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_470072ee0c9338e07f23966a391855ae_amadey_coinminer_darpapox_elex_manuscrypt_nymaim_rhadama.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-12_470072ee0c9338e07f23966a391855ae_amadey_coinminer_darpapox_elex_manuscrypt_nymaim_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 2.2MB
- SHA256 b7806c139edd53f37625c0faa8ed8e487aed63100792a008302e2d9b287337e6
- MD5 470072ee0c9338e07f23966a391855ae
- SHA1 a72f4f1d90b15eb07e704fcd72b71d7c4075ca0c
- SHA512 71778111144212bd0b6c38c09e1111453c7d7dac9c8ccd50c01d820a04f66e0857407bdfc8f959a851b4c520a37dc12c4776f9da477cb68b51f160010439d833
- SSDEEP 49152:+IjkgLmmpbTChxKCnFnQXBbrtgb/iQvu0UHOa+:DjkgLRp6hxvWbrtUTrUHOT
- TLSH T167B5EF013750CC61F65FC03242E59F757673AC213B33DA826A84767A1FF2A9BDB91286
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory