General
- Target 2026-08-02_781cdfc75d21d854e789f3538eb5ca71_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_trickbot_wannacry
- Size 2.0MB
- Sample260802-wmmxssdf75
- SHA256 14d58d2287688f95f87ea73f6617ee318cdd42d6144df67744da799c2185656c
- MD5 781cdfc75d21d854e789f3538eb5ca71
- SHA1 532a53e776623b99ca295bbe9e686bd84923699e
- SHA512 35475202e72e1b25c4cd448ed452525154a68dd7cbf2499253b21ab1ec4706c35e4dc4cf1e3d52c148f144fb5099b48acafc52b9c64e9a612d9d4021686b851a
- SSDEEP 49152:3NxMFbTChxKCnFnQXBbrtgb/iQvu0UHOag3Zc:3NxMF6hxvWbrtUTrUHOPc
- TLSH T1F5A5DE102790CCA0F39FD17202E16E797A73E8213733D99A9E44D4311BF2E5ADB91E5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_781cdfc75d21d854e789f3538eb5ca71_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_trickbot_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_781cdfc75d21d854e789f3538eb5ca71_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_trickbot_wannacry.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_781cdfc75d21d854e789f3538eb5ca71_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_trickbot_wannacry
- Size 2.0MB
- SHA256 14d58d2287688f95f87ea73f6617ee318cdd42d6144df67744da799c2185656c
- MD5 781cdfc75d21d854e789f3538eb5ca71
- SHA1 532a53e776623b99ca295bbe9e686bd84923699e
- SHA512 35475202e72e1b25c4cd448ed452525154a68dd7cbf2499253b21ab1ec4706c35e4dc4cf1e3d52c148f144fb5099b48acafc52b9c64e9a612d9d4021686b851a
- SSDEEP 49152:3NxMFbTChxKCnFnQXBbrtgb/iQvu0UHOag3Zc:3NxMF6hxvWbrtUTrUHOPc
- TLSH T1F5A5DE102790CCA0F39FD17202E16E797A73E8213733D99A9E44D4311BF2E5ADB91E5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory