General
- Target 2026-07-15_10f367e89a25e165848f50e8f73e29aa_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke-loader_stop_tofsee_wannacry
- Size 4.0MB
- Sample260715-pppqvafx6w
- SHA256 456dc1d6f2b58ca67cabb928b7269b3dcde053c3fa61e54eb85224a6fb406642
- MD5 10f367e89a25e165848f50e8f73e29aa
- SHA1 49cf514159cf5ee18f126cc74b9ddaa2577adf08
- SHA512 93a14e3758d24d9a825e30202814567fd55f0fb209fa950889e6e2b9e518b393e85a03e6cc7ed37cc7ed67d036aaec3d241df4234716ed267427fd06e1e9f536
- SSDEEP 98304:R49+9IuCysWngBSu/H8F6hxvWbrtUTrUHO9:R49AEyZox+NcIO9
- TLSH T1CC168C23CFB18D24C11A8F36C593666529331D98435A5A4F0BA0B43F5EF37866A9723F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-15_10f367e89a25e165848f50e8f73e29aa_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_10f367e89a25e165848f50e8f73e29aa_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-15_10f367e89a25e165848f50e8f73e29aa_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke-loader_stop_tofsee_wannacry
- Size 4.0MB
- SHA256 456dc1d6f2b58ca67cabb928b7269b3dcde053c3fa61e54eb85224a6fb406642
- MD5 10f367e89a25e165848f50e8f73e29aa
- SHA1 49cf514159cf5ee18f126cc74b9ddaa2577adf08
- SHA512 93a14e3758d24d9a825e30202814567fd55f0fb209fa950889e6e2b9e518b393e85a03e6cc7ed37cc7ed67d036aaec3d241df4234716ed267427fd06e1e9f536
- SSDEEP 98304:R49+9IuCysWngBSu/H8F6hxvWbrtUTrUHO9:R49AEyZox+NcIO9
- TLSH T1CC168C23CFB18D24C11A8F36C593666529331D98435A5A4F0BA0B43F5EF37866A9723F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory