2026-08-07_8a9bbd7b65a5920cd90cf6fd35fabae8_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry

General

Target
2026-08-07_8a9bbd7b65a5920cd90cf6fd35fabae8_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry
Size 280KB
Sample260807-eekn2axanc
SHA256 30c35d1bcb246c88a9274e1a27d043fc4968dbd8e91fb973c739f2bb84ae7da9
MD5 8a9bbd7b65a5920cd90cf6fd35fabae8
SHA1 0c49b706f55c9b1365912afdedab3dbb419fa92a
SHA512 e0e87002bb83958235ab2849d8dc89b7e944e347be361bf6e3df232b7198a8b79eb47c911f334b4a064de245c4a5d503077f3331514dab252770fc3538133d72
SSDEEP 6144:K72qcWxc5tTBsJWKFGUOfCG/2+/Q69RDh2Tsp:axpxc5tTG7FE6I2epwa
TLSH
T1B754DF1A39D089B3C0AFD07780D1BB39F77B32311362D94B7B5C9A750D22766E9262C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_8a9bbd7b65a5920cd90cf6fd35fabae8_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry

File Explorer

2026-08-07_8a9bbd7b65a5920cd90cf6fd35fabae8_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry

.exe 280KB

2026-08-07_8a9bbd7b65a5920cd90cf6fd35fabae8_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry

IMPHASH 8ee1d6ac14557b768dcccdd9bb83afc0
SHA256 30c35d1bcb246c88a9274e1a27d043fc4968dbd8e91fb973c739f2bb84ae7da9
MD5 8a9bbd7b65a5920cd90cf6fd35fabae8
SHA1 0c49b706f55c9b1365912afdedab3dbb419fa92a
SHA512 e0e87002bb83958235ab2849d8dc89b7e944e347be361bf6e3df232b7198a8b79eb47c911f334b4a064de245c4a5d503077f3331514dab252770fc3538133d72
SSDEEP 6144:K72qcWxc5tTBsJWKFGUOfCG/2+/Q69RDh2Tsp:axpxc5tTG7FE6I2epwa
TLSH
T1B754DF1A39D089B3C0AFD07780D1BB39F77B32311362D94B7B5C9A750D22766E9262C6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

278532

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress GetModuleHandleW GetEnvironmentVariableW GetLastError CreateDirectoryW FindClose FindFirstFileW CloseHandle CreateFileW FreeLibrary OpenProcess WideCharToMultiByte TerminateProcess GetCommandLineW GetModuleFileNameW CreateProcessW lstrlenW GetTempPathW GetModuleHandleA GetOEMCP GetACP SetEndOfFile FlushFileBuffers SetStdHandle GetStringTypeW HeapAlloc GetProcessHeap VirtualAlloc VirtualProtect VirtualFree LoadLibraryA IsBadReadPtr HeapFree DeleteFileW GetTempFileNameW CopyFileW RtlUnwind InterlockedDecrement InterlockedIncrement RaiseException GetStartupInfoW GetVersion ExitProcess HeapReAlloc GetCurrentThreadId TlsSetValue TlsAlloc SetLastError TlsGetValue InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentProcess HeapSize HeapDestroy HeapCreate IsBadWritePtr SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsA MultiByteToWideChar FreeEnvironmentStringsW GetEnvironmentStringsW GetEnvironmentStrings GetCommandLineA SetHandleCount GetStdHandle GetFileType GetStartupInfoA WriteFile GetModuleFileNameA SetFilePointer ReadFile IsBadCodePtr LCMapStringA LCMapStringW GetCPInfo GetStringTypeA

shell32

CommandLineToArgvW

psapi

GetModuleFileNameExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_8a9bbd7b65a5920cd90cf6fd35fabae8_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry

kernel32

shell32

psapi

generic