General
- Target 2026-08-16_fbe6559ad31afcce982b6bb94cccc50a_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee_wannacry
- Size 2.2MB
- Sample260816-ttylrsstct
- SHA256 e2381c9c2a192555da656b3b759782e00862d5114aefb6d28dc0fa470a1264fb
- MD5 fbe6559ad31afcce982b6bb94cccc50a
- SHA1 72718e5068035df92af29ae5b2d5060ac200d32a
- SHA512 776d34ca6db9f40ec8b76be789f126d680f170bfea0fa5d2c73f4a541f638e302466dafa9bb09da5312c850521f939b842b57363f941938b703f3b75fe809b29
- SSDEEP 49152:cCg0sdbTChxKCnFnQXBbrtgb/iQvu0UHOL:cCg1d6hxvWbrtUTrUHOL
- TLSH T19FB59DF51250C852F6AAC03902E13F32667FB9D027358B59ADD08EBD06F09F6966139F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_fbe6559ad31afcce982b6bb94cccc50a_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_fbe6559ad31afcce982b6bb94cccc50a_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-16_fbe6559ad31afcce982b6bb94cccc50a_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee_wannacry
- Size 2.2MB
- SHA256 e2381c9c2a192555da656b3b759782e00862d5114aefb6d28dc0fa470a1264fb
- MD5 fbe6559ad31afcce982b6bb94cccc50a
- SHA1 72718e5068035df92af29ae5b2d5060ac200d32a
- SHA512 776d34ca6db9f40ec8b76be789f126d680f170bfea0fa5d2c73f4a541f638e302466dafa9bb09da5312c850521f939b842b57363f941938b703f3b75fe809b29
- SSDEEP 49152:cCg0sdbTChxKCnFnQXBbrtgb/iQvu0UHOL:cCg1d6hxvWbrtUTrUHOL
- TLSH T19FB59DF51250C852F6AAC03902E13F32667FB9D027358B59ADD08EBD06F09F6966139F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory