General
- Target 2026-08-16_f6838f9bdff9f043a9e607e233ef0c01_coinminer_darpapox_elex_jaku_nymaim_redline-stealer_rhadamanthys_smoke-loader_tofsee_wannacry
- Size 1.9MB
- Sample260816-txecasee24
- SHA256 5cb9007ea655026880cbced21fe6b2f614fefe844a105d28b8af8a092c5dcf87
- MD5 f6838f9bdff9f043a9e607e233ef0c01
- SHA1 11f29b52f65b983cb76a75cd7fe8021ad2df96c2
- SHA512 d39f7065665af2c12350b68ead407d6e94c427cc255f74b1ea2d04b742c7544cad8c83618e08e5c9b95f63500a3869244c1f6cc1ccc7c51bc26688be1f2591a5
- SSDEEP 49152:WI+3lbTChxKCnFnQXBbrtgb/iQvu0UHOG:WI+3l6hxvWbrtUTrUHOG
- TLSH T13795DE162790CC21F39FC13683E4AEB2B57729212B73DD46AE4851352BF1E5BE3D121A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_f6838f9bdff9f043a9e607e233ef0c01_coinminer_darpapox_elex_jaku_nymaim_redline-stealer_rhad.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_f6838f9bdff9f043a9e607e233ef0c01_coinminer_darpapox_elex_jaku_nymaim_redline-stealer_rhad.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-16_f6838f9bdff9f043a9e607e233ef0c01_coinminer_darpapox_elex_jaku_nymaim_redline-stealer_rhadamanthys_smoke-loader_tofsee_wannacry
- Size 1.9MB
- SHA256 5cb9007ea655026880cbced21fe6b2f614fefe844a105d28b8af8a092c5dcf87
- MD5 f6838f9bdff9f043a9e607e233ef0c01
- SHA1 11f29b52f65b983cb76a75cd7fe8021ad2df96c2
- SHA512 d39f7065665af2c12350b68ead407d6e94c427cc255f74b1ea2d04b742c7544cad8c83618e08e5c9b95f63500a3869244c1f6cc1ccc7c51bc26688be1f2591a5
- SSDEEP 49152:WI+3lbTChxKCnFnQXBbrtgb/iQvu0UHOG:WI+3l6hxvWbrtUTrUHOG
- TLSH T13795DE162790CC21F39FC13683E4AEB2B57729212B73DD46AE4851352BF1E5BE3D121A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory