General
- Target 2026-08-10_70ddaaabf6229d4179cb65e92c51c8f3_cloudeye_coinminer_darpapox_elex_hijackloader_jaku_nymaim_rhadamanthys_wannacry
- Size 1.9MB
- Sample260810-vwfpeatfld
- SHA256 e254b0b8ac331018a0b99fcc3305000e9d0829a685a6b8f0e1901d97e46f71c4
- MD5 70ddaaabf6229d4179cb65e92c51c8f3
- SHA1 a8dc5b462b72a3a862471fe26ec23bae372df0e2
- SHA512 0c05ef7c892e06982dc07c758e14884fe88d347a2553ebf4fd7eb7ae9d8e2e2750ee2dd3f6d5e320b7134d68a684a93529cf5ee583a7edb1773136e5911636e9
- SSDEEP 49152:1LAjw09bTChxKCnFnQXBbrtgb/iQvu0UHOaT:1LAjH96hxvWbrtUTrUHOy
- TLSH T11C95FF112780CC21F66FD17643E1AE7AB573AD213733C99A5A0879312BF2E5FE781192
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
2026-08-10_70ddaaabf6229d4179cb65e92c51c8f3_cloudeye_coinminer_darpapox_elex_hijackloader_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_70ddaaabf6229d4179cb65e92c51c8f3_cloudeye_coinminer_darpapox_elex_hijackloader_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_70ddaaabf6229d4179cb65e92c51c8f3_cloudeye_coinminer_darpapox_elex_hijackloader_jaku_nymaim_rhadamanthys_wannacry
- Size 1.9MB
- SHA256 e254b0b8ac331018a0b99fcc3305000e9d0829a685a6b8f0e1901d97e46f71c4
- MD5 70ddaaabf6229d4179cb65e92c51c8f3
- SHA1 a8dc5b462b72a3a862471fe26ec23bae372df0e2
- SHA512 0c05ef7c892e06982dc07c758e14884fe88d347a2553ebf4fd7eb7ae9d8e2e2750ee2dd3f6d5e320b7134d68a684a93529cf5ee583a7edb1773136e5911636e9
- SSDEEP 49152:1LAjw09bTChxKCnFnQXBbrtgb/iQvu0UHOaT:1LAjH96hxvWbrtUTrUHOy
- TLSH T11C95FF112780CC21F66FD17643E1AE7AB573AD213733C99A5A0879312BF2E5FE781192
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory