General
- Target 2026-08-16_c9ccbc12a29b946481bc338f8f258bd5_coinminer_darpapox_elex_hijackloader_nymaim_rhadamanthys_stop_wannacry
- Size 2.3MB
- Sample260816-vc1v8sscrb
- SHA256 c41f8b6507c53a8c1a83f2c1e14aab5923e2874f9c9504848706c9fb69b70483
- MD5 c9ccbc12a29b946481bc338f8f258bd5
- SHA1 1c5ba1a98d055a2e5206ff520cc5839e8e3af604
- SHA512 28338cabe36ae00adebc8fa4032f0c197e25e1b1cba315e2b30ea546cfe450f79f62e96ab1546ff62dc9e6ae3fd053df76aa9e1f06f510a9e088ba8317b682cf
- SSDEEP 49152:Q1SKuDlgCxXNbTChxKCnFnQXBbrtgb/iQvu0UHOU:Q8DBgCxXN6hxvWbrtUTrUHOU
- TLSH T18DB5E00133C4C861F66BA9B117E94E35787B74203736DDCB6B944D392BB0E4ADBA131A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_c9ccbc12a29b946481bc338f8f258bd5_coinminer_darpapox_elex_hijackloader_nymaim_rhadamanthys_stop_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_c9ccbc12a29b946481bc338f8f258bd5_coinminer_darpapox_elex_hijackloader_nymaim_rhadamanthys_stop_wannacry.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-16_c9ccbc12a29b946481bc338f8f258bd5_coinminer_darpapox_elex_hijackloader_nymaim_rhadamanthys_stop_wannacry
- Size 2.3MB
- SHA256 c41f8b6507c53a8c1a83f2c1e14aab5923e2874f9c9504848706c9fb69b70483
- MD5 c9ccbc12a29b946481bc338f8f258bd5
- SHA1 1c5ba1a98d055a2e5206ff520cc5839e8e3af604
- SHA512 28338cabe36ae00adebc8fa4032f0c197e25e1b1cba315e2b30ea546cfe450f79f62e96ab1546ff62dc9e6ae3fd053df76aa9e1f06f510a9e088ba8317b682cf
- SSDEEP 49152:Q1SKuDlgCxXNbTChxKCnFnQXBbrtgb/iQvu0UHOU:Q8DBgCxXN6hxvWbrtUTrUHOU
- TLSH T18DB5E00133C4C861F66BA9B117E94E35787B74203736DDCB6B944D392BB0E4ADBA131A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Drops file in System32 directory