General
- Target 2026-08-04_0f72d2d8574089f463464cc81b3ee30d_amadey_coinminer_elex_glassworm_luca-stealer_njrat_wannacry
- Size 48.8MB
- Sample260804-3dqqnashrd
- SHA256 e617a4393f1cf326c5469c9b527097cdce1a7c5bf3691823d4ef056d35985de5
- MD5 0f72d2d8574089f463464cc81b3ee30d
- SHA1 de18ecdd1f2506d85965c8f33ef1003e4f32f2a2
- SHA512 8d33795f92d4803dbd09890a38cd90c0ae45e4042283d2c744aa03d7ab629ccab6c7f55cec92fd3f9b002841dd38dc51980236191af35a0e9bf27746adf47f5d
- SSDEEP 1572864:z/s5cfVX+VR1ciMZ68NNOR456/VZDjA2xzts:zQ6VUR1q68NNU4Er42rs
- TLSH T146B73315BFB6C474D366093968A9AF3838D96F1B1D3198A7F3D04B190C30AE2F935A1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-04_0f72d2d8574089f463464cc81b3ee30d_amadey_coinminer_elex_glassworm_luca-stealer_njrat_wannacry.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_0f72d2d8574089f463464cc81b3ee30d_amadey_coinminer_elex_glassworm_luca-stealer_njrat_wannacry.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_0f72d2d8574089f463464cc81b3ee30d_amadey_coinminer_elex_glassworm_luca-stealer_njrat_wannacry
- Size 48.8MB
- SHA256 e617a4393f1cf326c5469c9b527097cdce1a7c5bf3691823d4ef056d35985de5
- MD5 0f72d2d8574089f463464cc81b3ee30d
- SHA1 de18ecdd1f2506d85965c8f33ef1003e4f32f2a2
- SHA512 8d33795f92d4803dbd09890a38cd90c0ae45e4042283d2c744aa03d7ab629ccab6c7f55cec92fd3f9b002841dd38dc51980236191af35a0e9bf27746adf47f5d
- SSDEEP 1572864:z/s5cfVX+VR1ciMZ68NNOR456/VZDjA2xzts:zQ6VUR1q68NNU4Er42rs
- TLSH T146B73315BFB6C474D366093968A9AF3838D96F1B1D3198A7F3D04B190C30AE2F935A1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.