General
- Target 2026-08-16_f821d15ebe744a3411cddd718e6b7459_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_stealc_stop_wannacry
- Size 2.0MB
- Sample260816-twvb5aek71
- SHA256 dd519c5d2830901566a4a7bc36aba6e7a51afb888cd44492695fe2e699175896
- MD5 f821d15ebe744a3411cddd718e6b7459
- SHA1 372d9fdb2011c10e1953a8aaf0f30434f1ac20a8
- SHA512 58000f20fbd83b3438b402eb9e750bb097c6721cf34d4c2b98d0b381ac3fef07cf5b44c5208d914f2530b0e0bdf8b53dc918a21ff287428343913a4558175c9b
- SSDEEP 49152:7F23TUJbTChxKCnFnQXBbrtgb/iQvu0UHOC:7c3QJ6hxvWbrtUTrUHOC
- TLSH T1B0A5DE212790CD62F62FD47243E59E39B97365213333CD866E8819356BF0E9BD3E2285
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_f821d15ebe744a3411cddd718e6b7459_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_stealc_stop_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_f821d15ebe744a3411cddd718e6b7459_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_stealc_stop_wannacry.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-16_f821d15ebe744a3411cddd718e6b7459_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_stealc_stop_wannacry
- Size 2.0MB
- SHA256 dd519c5d2830901566a4a7bc36aba6e7a51afb888cd44492695fe2e699175896
- MD5 f821d15ebe744a3411cddd718e6b7459
- SHA1 372d9fdb2011c10e1953a8aaf0f30434f1ac20a8
- SHA512 58000f20fbd83b3438b402eb9e750bb097c6721cf34d4c2b98d0b381ac3fef07cf5b44c5208d914f2530b0e0bdf8b53dc918a21ff287428343913a4558175c9b
- SSDEEP 49152:7F23TUJbTChxKCnFnQXBbrtgb/iQvu0UHOC:7c3QJ6hxvWbrtUTrUHOC
- TLSH T1B0A5DE212790CD62F62FD47243E59E39B97365213333CD866E8819356BF0E9BD3E2285
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory