General
- Target 2026-07-22_3ec7965a63be1c13204a1a4a9ac44fa3_amadey_coinminer_darpapox_elex_jaku_nymaim_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 1.8MB
- Sample260722-ygv3bstcph
- SHA256 18795ebc44a9b9ddd2708902cef3422f9a0d5c0827dd64197e9152e6312f68a5
- MD5 3ec7965a63be1c13204a1a4a9ac44fa3
- SHA1 3dfb35832fb071e6d4d85f9f3817379dbe48d399
- SHA512 91323f8622df97d6762bad91e33c7f4de747f96db9c5b356aff4775e4f49634e15c24e0373ee23d219a602b8312d8a02dd5960c02ecdeb289ac209f1cbb6e59a
- SSDEEP 24576:4BvXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0/:4BFbTChxKCnFnQXBbrtgb/iQvu0UHO9x
- TLSH T17D95FF122790CC61F32FC07243E5AE79B67369213B33DC826A4865352BF2E5FE792156
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_3ec7965a63be1c13204a1a4a9ac44fa3_amadey_coinminer_darpapox_elex_jaku_nymaim_redline-steal.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_3ec7965a63be1c13204a1a4a9ac44fa3_amadey_coinminer_darpapox_elex_jaku_nymaim_redline-steal.exe
Resource
win11ltsc2024-20260709-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-22_3ec7965a63be1c13204a1a4a9ac44fa3_amadey_coinminer_darpapox_elex_jaku_nymaim_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 1.8MB
- SHA256 18795ebc44a9b9ddd2708902cef3422f9a0d5c0827dd64197e9152e6312f68a5
- MD5 3ec7965a63be1c13204a1a4a9ac44fa3
- SHA1 3dfb35832fb071e6d4d85f9f3817379dbe48d399
- SHA512 91323f8622df97d6762bad91e33c7f4de747f96db9c5b356aff4775e4f49634e15c24e0373ee23d219a602b8312d8a02dd5960c02ecdeb289ac209f1cbb6e59a
- SSDEEP 24576:4BvXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0/:4BFbTChxKCnFnQXBbrtgb/iQvu0UHO9x
- TLSH T17D95FF122790CC61F32FC07243E5AE79B67369213B33DC826A4865352BF2E5FE792156
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10Modifies visibility of file extensions in Explorer
Modifies visibility of hidden/system files in Explorer
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
3