General
- Target 2026-08-14_fe81db046fb0095ac5ffe16a877a51d0_amadey_coinminer_elex_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop_wannacry
- Size 2.7MB
- Sample260814-n6tkpasdqb
- SHA256 45feaa63f7070858ec7097a3d65ae81fe70c91399d72d596b758ba3782487b2b
- MD5 fe81db046fb0095ac5ffe16a877a51d0
- SHA1 d400f79593971710ae1b61f7085a925591850c63
- SHA512 e3ceeeac78afe3e42afbd1fbd7f6cfd7028f742ed7cae90fef9349fe1969157cb57acc9988ae163f6930c673882de12273771616daa5b8953996572e46caf6e2
- SSDEEP 49152:bqi0ORwPorrm9bMUJUfyzpoFhL2lgxNHxfApmY+V8TjFJspDLoVMgdkLq:bqi/YMUJVzpYL2l9MSFJspDLOMgdt
- TLSH T19DD512556380CC62F32FD0718AE69F7172333C206B36CD962F45B2351AF0A9EE3A6655
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_fe81db046fb0095ac5ffe16a877a51d0_amadey_coinminer_elex_nymaim_redline-stealer_rhadamanthy.exe
Resource
win10v2004-20260513-en
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_fe81db046fb0095ac5ffe16a877a51d0_amadey_coinminer_elex_nymaim_redline-stealer_rhadamanthy.exe
Resource
win11ltsc2024-20260709-en
17 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-14_fe81db046fb0095ac5ffe16a877a51d0_amadey_coinminer_elex_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop_wannacry
- Size 2.7MB
- SHA256 45feaa63f7070858ec7097a3d65ae81fe70c91399d72d596b758ba3782487b2b
- MD5 fe81db046fb0095ac5ffe16a877a51d0
- SHA1 d400f79593971710ae1b61f7085a925591850c63
- SHA512 e3ceeeac78afe3e42afbd1fbd7f6cfd7028f742ed7cae90fef9349fe1969157cb57acc9988ae163f6930c673882de12273771616daa5b8953996572e46caf6e2
- SSDEEP 49152:bqi0ORwPorrm9bMUJUfyzpoFhL2lgxNHxfApmY+V8TjFJspDLoVMgdkLq:bqi/YMUJVzpYL2l9MSFJspDLOMgdt
- TLSH T19DD512556380CC62F32FD0718AE69F7172333C206B36CD962F45B2351AF0A9EE3A6655
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1