General
- Target 2026-08-05_e567bf8b44792d4e48f74db4a86c9c8f_amadey_coinminer_elex_jaku_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop_wannacry
- Size 1.0MB
- Sample260805-vq7wpscf87
- SHA256 48311d1c7f448e8a962fedd213f05c36b5607e1c5dbddfcbb0711152dedfea3e
- MD5 e567bf8b44792d4e48f74db4a86c9c8f
- SHA1 96025cddba4f7721023986bd8dbefa6e6089c7ab
- SHA512 f4eb4b0299933e610c41eb8ce6c2c8252f3abed1fd245bf44ade532bcbf096f5d2c5e9e0e141b07d70dffb7c9b096af957b97baa82c616eb0c958136aadad662
- SSDEEP 24576:78GRzatThRiVNbLGJv6plFh9iGa2oMYMgdsHGex:7R8TjFJspDLoVMgdkLx
- TLSH T19035F1193B80CCB1E25FC07246D0AF34B67739212776C98B2F4895391FF1A5EE7A2256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_e567bf8b44792d4e48f74db4a86c9c8f_amadey_coinminer_elex_jaku_nymaim_redline-stealer_rhadam.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_e567bf8b44792d4e48f74db4a86c9c8f_amadey_coinminer_elex_jaku_nymaim_redline-stealer_rhadam.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-05_e567bf8b44792d4e48f74db4a86c9c8f_amadey_coinminer_elex_jaku_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop_wannacry
- Size 1.0MB
- SHA256 48311d1c7f448e8a962fedd213f05c36b5607e1c5dbddfcbb0711152dedfea3e
- MD5 e567bf8b44792d4e48f74db4a86c9c8f
- SHA1 96025cddba4f7721023986bd8dbefa6e6089c7ab
- SHA512 f4eb4b0299933e610c41eb8ce6c2c8252f3abed1fd245bf44ade532bcbf096f5d2c5e9e0e141b07d70dffb7c9b096af957b97baa82c616eb0c958136aadad662
- SSDEEP 24576:78GRzatThRiVNbLGJv6plFh9iGa2oMYMgdsHGex:7R8TjFJspDLoVMgdkLx
- TLSH T19035F1193B80CCB1E25FC07246D0AF34B67739212776C98B2F4895391FF1A5EE7A2256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application