General
- Target 2026-08-16_1ba3ab3380646e60295602d47357b67e_coinminer_darpapox_elex_nymaim_rhadamanthys_stop_wannacry
- Size 2.3MB
- Sample260816-w9hxcsvwhs
- SHA256 3dcccc36ac6bfd8e0bb99b92ebeb9678a825cb7cf53d45e90dceed6c1815bfc5
- MD5 1ba3ab3380646e60295602d47357b67e
- SHA1 58c58305db92910690c96d3617ba1951f4bb7dc8
- SHA512 c72e8161ace5aa35d500c59117bb8641e7fc2f4f88fd851fd0525ea3d6db0ec4fbef8d7b79443501aecb777ad12aec1639efaa3d1e8cb2360baad291e7fab768
- SSDEEP 49152:Ew9YQz+cpEvzJwClbTChxKCnFnQXBbrtgb/iQvu0UHOB:Ew9MzJwCl6hxvWbrtUTrUHOB
- TLSH T1FAB5E00133D4C8A1F76BA9B117E94E35787B78206732DDCB6B944D381BB0E4ADBA1319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_1ba3ab3380646e60295602d47357b67e_coinminer_darpapox_elex_nymaim_rhadamanthys_stop_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_1ba3ab3380646e60295602d47357b67e_coinminer_darpapox_elex_nymaim_rhadamanthys_stop_wannacry.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-16_1ba3ab3380646e60295602d47357b67e_coinminer_darpapox_elex_nymaim_rhadamanthys_stop_wannacry
- Size 2.3MB
- SHA256 3dcccc36ac6bfd8e0bb99b92ebeb9678a825cb7cf53d45e90dceed6c1815bfc5
- MD5 1ba3ab3380646e60295602d47357b67e
- SHA1 58c58305db92910690c96d3617ba1951f4bb7dc8
- SHA512 c72e8161ace5aa35d500c59117bb8641e7fc2f4f88fd851fd0525ea3d6db0ec4fbef8d7b79443501aecb777ad12aec1639efaa3d1e8cb2360baad291e7fab768
- SSDEEP 49152:Ew9YQz+cpEvzJwClbTChxKCnFnQXBbrtgb/iQvu0UHOB:Ew9MzJwCl6hxvWbrtUTrUHOB
- TLSH T1FAB5E00133D4C8A1F76BA9B117E94E35787B78206732DDCB6B944D381BB0E4ADBA1319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory