General
- Target 2026-08-16_b1849979ce787eb5e04b2df77772aa3e_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_stealc_stop_wannacry
- Size 2.0MB
- Sample260816-vm4d4ss1bx
- SHA256 a88e3fa60bd0dd4df455c4dda9eacefc3d55a168529d02e78535c62d96168d8f
- MD5 b1849979ce787eb5e04b2df77772aa3e
- SHA1 5a965c4dfedb33fadc4f7cffce2b431355fbb550
- SHA512 4a3adc94ecd42cc5657eb3f283e5e672c64606158d0e3b7108a7d22ed230ed0f5881a04999576ecb6dda90ed6ac28768de31844b28a3973af346d4e14c1f08c8
- SSDEEP 49152:oF23JpbTChxKCnFnQXBbrtgb/iQvu0UHOu:oc3Jp6hxvWbrtUTrUHOu
- TLSH T117A5DE212790CD62F72FD47243E59E39B97365213333C9866E4819356BF0E9BD3E2289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_b1849979ce787eb5e04b2df77772aa3e_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_stealc_stop_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_b1849979ce787eb5e04b2df77772aa3e_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_stealc_stop_wannacry.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-16_b1849979ce787eb5e04b2df77772aa3e_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_stealc_stop_wannacry
- Size 2.0MB
- SHA256 a88e3fa60bd0dd4df455c4dda9eacefc3d55a168529d02e78535c62d96168d8f
- MD5 b1849979ce787eb5e04b2df77772aa3e
- SHA1 5a965c4dfedb33fadc4f7cffce2b431355fbb550
- SHA512 4a3adc94ecd42cc5657eb3f283e5e672c64606158d0e3b7108a7d22ed230ed0f5881a04999576ecb6dda90ed6ac28768de31844b28a3973af346d4e14c1f08c8
- SSDEEP 49152:oF23JpbTChxKCnFnQXBbrtgb/iQvu0UHOu:oc3Jp6hxvWbrtUTrUHOu
- TLSH T117A5DE212790CD62F72FD47243E59E39B97365213333C9866E4819356BF0E9BD3E2289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory