General
- Target 2026-08-03_d042fac9b0a3d52f49317ac7cfb1fecb_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry
- Size 6.0MB
- Sample260804-c6xfssbg42
- SHA256 077a41ded52a7bc5ab2b17e2b8c573b2353713e93118605af8d5faf9ebda87fa
- MD5 d042fac9b0a3d52f49317ac7cfb1fecb
- SHA1 3ea9da5263f07c0c6146fffea4d18a6c789fb551
- SHA512 b2bf94a4d08b276eb145648b639b7e0a7c349c771c4d9d99e7a6e017daae004bb14f542af879891eb3c430717cc9c35bbf0abc760c190ddef993bbc9ec554bcf
- SSDEEP 98304:LZQLmFQ+pJonN69Epgcu7FNEiMeTPL1R6teYEEB6hxvWbrtUTrUHOr:dQLmFLpJkN6H7F5MebL1RbEkx+NcIOr
- TLSH T1B85623102381CD61F36FD0B643E1AFB8B5B769223723C949AE5818709BF2E0FE786555
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_d042fac9b0a3d52f49317ac7cfb1fecb_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_d042fac9b0a3d52f49317ac7cfb1fecb_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260709-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_d042fac9b0a3d52f49317ac7cfb1fecb_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry
- Size 6.0MB
- SHA256 077a41ded52a7bc5ab2b17e2b8c573b2353713e93118605af8d5faf9ebda87fa
- MD5 d042fac9b0a3d52f49317ac7cfb1fecb
- SHA1 3ea9da5263f07c0c6146fffea4d18a6c789fb551
- SHA512 b2bf94a4d08b276eb145648b639b7e0a7c349c771c4d9d99e7a6e017daae004bb14f542af879891eb3c430717cc9c35bbf0abc760c190ddef993bbc9ec554bcf
- SSDEEP 98304:LZQLmFQ+pJonN69Epgcu7FNEiMeTPL1R6teYEEB6hxvWbrtUTrUHOr:dQLmFLpJkN6H7F5MebL1RbEkx+NcIOr
- TLSH T1B85623102381CD61F36FD0B643E1AFB8B5B769223723C949AE5818709BF2E0FE786555
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory