General
- Target 2026-07-23_7d19046f189ddba3efbafbf1ee8de970_amadey_coinminer_darpapox_elex_jaku_nymaim_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 1.8MB
- Sample260723-s9b72abg65
- SHA256 f2cb41a94cd08ead9b9766f31145dfcd4ec3a46966862c3a66a135051afbd16f
- MD5 7d19046f189ddba3efbafbf1ee8de970
- SHA1 70399a8acce31151e7ce97f462032c1be192599d
- SHA512 9e52035fc1ea4883a9d1af88525f9888948b3b607675413960592dfb126d2d05f086aa3695cffea1073b814d9e9093f731f680ed3500a9022f36a67754c100a9
- SSDEEP 24576:4J7XdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0c:4JBbTChxKCnFnQXBbrtgb/iQvu0UHO9q
- TLSH T1B795FF122790CC61F32FC07243E5AE79B67369213B33DC826A4865352BF2E9FE791156
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_7d19046f189ddba3efbafbf1ee8de970_amadey_coinminer_darpapox_elex_jaku_nymaim_redline-steal.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_7d19046f189ddba3efbafbf1ee8de970_amadey_coinminer_darpapox_elex_jaku_nymaim_redline-steal.exe
Resource
win11ltsc2024-20260709-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_7d19046f189ddba3efbafbf1ee8de970_amadey_coinminer_darpapox_elex_jaku_nymaim_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 1.8MB
- SHA256 f2cb41a94cd08ead9b9766f31145dfcd4ec3a46966862c3a66a135051afbd16f
- MD5 7d19046f189ddba3efbafbf1ee8de970
- SHA1 70399a8acce31151e7ce97f462032c1be192599d
- SHA512 9e52035fc1ea4883a9d1af88525f9888948b3b607675413960592dfb126d2d05f086aa3695cffea1073b814d9e9093f731f680ed3500a9022f36a67754c100a9
- SSDEEP 24576:4J7XdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0c:4JBbTChxKCnFnQXBbrtgb/iQvu0UHO9q
- TLSH T1B795FF122790CC61F32FC07243E5AE79B67369213B33DC826A4865352BF2E9FE791156
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of file extensions in Explorer
-
Modifies visibility of hidden/system files in Explorer
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
3