General
- Target 2026-08-14_5a2873c0634be85e24d74a2b3041afd2_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry
- Size 1.6MB
- Sample260814-3ste4athkh
- SHA256 31cad2e30d3f673e60b51319831a8ac7f53d50b6c305a86e222d094e07af0f0c
- MD5 5a2873c0634be85e24d74a2b3041afd2
- SHA1 3f153412d6e0a0d306bedc1875941cfc739c5dd2
- SHA512 2ee03495240d2359a04f0a5a17c063c9373939f54354d70dc42e22fc55a064e0f3219dd6962d45d070ac017c471bc9af56eb959b52fe01babb72dc6a9169eb9f
- SSDEEP 24576:OIXW/8yw1ez54lIYF5SXYHUGRzatThRiVNbLGJv6plFh9iGa2oMYMgdsHGNd:J9bC4lIlK8TjFJspDLoVMgdkUd
- TLSH T11E75F126F683C0F3E55760B054F9AB716936BA35173689C3BBA06D391E701C1BA3934E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_5a2873c0634be85e24d74a2b3041afd2_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_5a2873c0634be85e24d74a2b3041afd2_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260709-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-14_5a2873c0634be85e24d74a2b3041afd2_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry
- Size 1.6MB
- SHA256 31cad2e30d3f673e60b51319831a8ac7f53d50b6c305a86e222d094e07af0f0c
- MD5 5a2873c0634be85e24d74a2b3041afd2
- SHA1 3f153412d6e0a0d306bedc1875941cfc739c5dd2
- SHA512 2ee03495240d2359a04f0a5a17c063c9373939f54354d70dc42e22fc55a064e0f3219dd6962d45d070ac017c471bc9af56eb959b52fe01babb72dc6a9169eb9f
- SSDEEP 24576:OIXW/8yw1ez54lIYF5SXYHUGRzatThRiVNbLGJv6plFh9iGa2oMYMgdsHGNd:J9bC4lIlK8TjFJspDLoVMgdkUd
- TLSH T11E75F126F683C0F3E55760B054F9AB716936BA35173689C3BBA06D391E701C1BA3934E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of file extensions in Explorer
-
Modifies visibility of hidden/system files in Explorer
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
3