General
- Target 2026-08-16_da3706405294ff0d9583aa3001651380_amadey_coinminer_darpapox_elex_glassworm_nymaim_rhadamanthys_smoke-loader_wannacry
- Size 3.3MB
- Sample260816-t7dthssbpc
- SHA256 7cd21912dad578710b728c0ce39ef18dcbab4aa1912733852b0e8bf51ea4189a
- MD5 da3706405294ff0d9583aa3001651380
- SHA1 4c24492473af88aa0ea6e8773946d2f9345e7d24
- SHA512 4e961e0f3f91c84b040081f5144dc59d969eb998dfd03b10e379c82f4d10468aa2f106b3e26e28dc79ec8b49aff86e2b2de34e7ad8d3d1021a92ee5c91895ceb
- SSDEEP 98304:cxruFH2ryQA6F4LysmXnwssEKGhba6UxwqlZ6hxvWbrtUTrUHOJ:iruF98nsGM6Uxwqlcx+NcIOJ
- TLSH T12AF5D1203B90C876D367613186CA5779B2B796303B7596872BD01E382FB0D93DA1C76B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_da3706405294ff0d9583aa3001651380_amadey_coinminer_darpapox_elex_glassworm_nymaim_rhadaman.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_da3706405294ff0d9583aa3001651380_amadey_coinminer_darpapox_elex_glassworm_nymaim_rhadaman.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-16_da3706405294ff0d9583aa3001651380_amadey_coinminer_darpapox_elex_glassworm_nymaim_rhadamanthys_smoke-loader_wannacry
- Size 3.3MB
- SHA256 7cd21912dad578710b728c0ce39ef18dcbab4aa1912733852b0e8bf51ea4189a
- MD5 da3706405294ff0d9583aa3001651380
- SHA1 4c24492473af88aa0ea6e8773946d2f9345e7d24
- SHA512 4e961e0f3f91c84b040081f5144dc59d969eb998dfd03b10e379c82f4d10468aa2f106b3e26e28dc79ec8b49aff86e2b2de34e7ad8d3d1021a92ee5c91895ceb
- SSDEEP 98304:cxruFH2ryQA6F4LysmXnwssEKGhba6UxwqlZ6hxvWbrtUTrUHOJ:iruF98nsGM6Uxwqlcx+NcIOJ
- TLSH T12AF5D1203B90C876D367613186CA5779B2B796303B7596872BD01E382FB0D93DA1C76B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory