General
- Target 2026-08-16_b4d367b3cd2552dcd32db64416b72e70_coinminer_darpapox_elex_hijackloader_jaku_nymaim_remcos_rhadamanthys_stealc_stop_tofsee_wannacry
- Size 2.0MB
- Sample260816-vlghysszev
- SHA256 f95dcd8e0815844be833bcc4afc71c14c517fb5484ddd3471f229361660a4632
- MD5 b4d367b3cd2552dcd32db64416b72e70
- SHA1 96105a180e3b5dd3d84ad02c72654970a2d54050
- SHA512 9a58a556703bded1090ddac342d8fbfff7dcb3e7f0bef52cb8500aaf73e12948e7a217fd39a97a159c82fa33192e125586d5c32b3d8e70a4380feb778513da26
- SSDEEP 49152:S5FNh431bTChxKCnFnQXBbrtgb/iQvu0UHO9:S5m316hxvWbrtUTrUHO9
- TLSH T15595DE2427A0CC62F3AFD07243E49E75B97765213733C89A6F8805351BF1E9BE3A1256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_b4d367b3cd2552dcd32db64416b72e70_coinminer_darpapox_elex_hijackloader_jaku_nymaim_remcos_.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_b4d367b3cd2552dcd32db64416b72e70_coinminer_darpapox_elex_hijackloader_jaku_nymaim_remcos_.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-16_b4d367b3cd2552dcd32db64416b72e70_coinminer_darpapox_elex_hijackloader_jaku_nymaim_remcos_rhadamanthys_stealc_stop_tofsee_wannacry
- Size 2.0MB
- SHA256 f95dcd8e0815844be833bcc4afc71c14c517fb5484ddd3471f229361660a4632
- MD5 b4d367b3cd2552dcd32db64416b72e70
- SHA1 96105a180e3b5dd3d84ad02c72654970a2d54050
- SHA512 9a58a556703bded1090ddac342d8fbfff7dcb3e7f0bef52cb8500aaf73e12948e7a217fd39a97a159c82fa33192e125586d5c32b3d8e70a4380feb778513da26
- SSDEEP 49152:S5FNh431bTChxKCnFnQXBbrtgb/iQvu0UHO9:S5m316hxvWbrtUTrUHO9
- TLSH T15595DE2427A0CC62F3AFD07243E49E75B97765213733C89A6F8805351BF1E9BE3A1256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory