General
- Target 2026-08-05_c7510780b367831f9262c4ced3f9b101_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke-loader_wannacry
- Size 2.4MB
- Sample260805-lt7wfahc92
- SHA256 2e0bea02a706416698dff091235acdf993786c47e56f8a960a46f649b6d814da
- MD5 c7510780b367831f9262c4ced3f9b101
- SHA1 e0626f741cf2ed0a2dd939adf8ec4b1bacb40a70
- SHA512 1a8a14615d6081d44159893e57eb0afc71276f8439dfb2516d92a2895bac134da8817923e9f06a461574d2a83cafc783762450f79a6c56af2040f3fc962f5ea0
- SSDEEP 24576:wxU92WXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaT:Y+BbTChxKCnFnQXBbrtgb/iQvu0UHOj
- TLSH T1DBC501123780CF60E76FC072C2D67E75F67368212732C986EB4865355BF2ADAE7A2045
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_c7510780b367831f9262c4ced3f9b101_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke-loader_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_c7510780b367831f9262c4ced3f9b101_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke-loader_wannacry.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-05_c7510780b367831f9262c4ced3f9b101_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke-loader_wannacry
- Size 2.4MB
- SHA256 2e0bea02a706416698dff091235acdf993786c47e56f8a960a46f649b6d814da
- MD5 c7510780b367831f9262c4ced3f9b101
- SHA1 e0626f741cf2ed0a2dd939adf8ec4b1bacb40a70
- SHA512 1a8a14615d6081d44159893e57eb0afc71276f8439dfb2516d92a2895bac134da8817923e9f06a461574d2a83cafc783762450f79a6c56af2040f3fc962f5ea0
- SSDEEP 24576:wxU92WXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaT:Y+BbTChxKCnFnQXBbrtgb/iQvu0UHOj
- TLSH T1DBC501123780CF60E76FC072C2D67E75F67368212732C986EB4865355BF2ADAE7A2045
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory