General
- Target 2026-08-04_fa06ef79d2a2ac5677f818543c46f561_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry
- Size 6.0MB
- Sample260805-abgqragj2w
- SHA256 edc02ac1cb9de08e7b0c62ac1a3222e196657605fae25577eb54d643243333e7
- MD5 fa06ef79d2a2ac5677f818543c46f561
- SHA1 d007edc848871a1d714a68cdbb1ac5e5a449b52c
- SHA512 86b1ffb4ca68599faa457034d6ac4424c214e12a6744ca93d6270eeacf49eafc12ff8f0ab19d900e5bf513175be68a6208ed3b016ac061a10699f9722fc7a025
- SSDEEP 98304:LZQLmFQ+pJonN69Epgcu7FNEiMeTPL1R6teYQE96hxvWbrtUTrUHOb:dQLmFLpJkN6H7F5MebL1RHEAx+NcIOb
- TLSH T1355623202381CD61F36FD0B643E1AFB8B5B768223723C949AE5858709BF1E0EE7C6555
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_fa06ef79d2a2ac5677f818543c46f561_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_fa06ef79d2a2ac5677f818543c46f561_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260709-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_fa06ef79d2a2ac5677f818543c46f561_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry
- Size 6.0MB
- SHA256 edc02ac1cb9de08e7b0c62ac1a3222e196657605fae25577eb54d643243333e7
- MD5 fa06ef79d2a2ac5677f818543c46f561
- SHA1 d007edc848871a1d714a68cdbb1ac5e5a449b52c
- SHA512 86b1ffb4ca68599faa457034d6ac4424c214e12a6744ca93d6270eeacf49eafc12ff8f0ab19d900e5bf513175be68a6208ed3b016ac061a10699f9722fc7a025
- SSDEEP 98304:LZQLmFQ+pJonN69Epgcu7FNEiMeTPL1R6teYQE96hxvWbrtUTrUHOb:dQLmFLpJkN6H7F5MebL1RHEAx+NcIOb
- TLSH T1355623202381CD61F36FD0B643E1AFB8B5B768223723C949AE5858709BF1E0EE7C6555
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory