General
- Target 2026-08-16_4c7174d727da9f1cb14753d4331f12cc_coinminer_darpapox_elex_hijackloader_nymaim_rhadamanthys_stop_wannacry
- Size 2.3MB
- Sample260816-wp3q2afq6w
- SHA256 f965c8e0e7efe18dd3649866b2bc6a48bff29846c900e726f02dbac38aa844ad
- MD5 4c7174d727da9f1cb14753d4331f12cc
- SHA1 0f71ae33d0b3493639ba893b87d377b032a73733
- SHA512 21b51d6fd2006ec45fd38e76ced7d50cfc393a05e084f4ec2e3d58edd2b6d498b0d149a4f8c681f190c89d67920abbde0e24a4d7787fa6b061980243f7bf1eaa
- SSDEEP 49152:Q1SKuDlgCx3lbTChxKCnFnQXBbrtgb/iQvu0UHOp:Q8DBgCx3l6hxvWbrtUTrUHOp
- TLSH T1C2B5E00133C4C861F67BA9B117E94E35787B74202736DDCB6B944D392BB0E4ADBA131A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_4c7174d727da9f1cb14753d4331f12cc_coinminer_darpapox_elex_hijackloader_nymaim_rhadamanthys_stop_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_4c7174d727da9f1cb14753d4331f12cc_coinminer_darpapox_elex_hijackloader_nymaim_rhadamanthys_stop_wannacry.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-16_4c7174d727da9f1cb14753d4331f12cc_coinminer_darpapox_elex_hijackloader_nymaim_rhadamanthys_stop_wannacry
- Size 2.3MB
- SHA256 f965c8e0e7efe18dd3649866b2bc6a48bff29846c900e726f02dbac38aa844ad
- MD5 4c7174d727da9f1cb14753d4331f12cc
- SHA1 0f71ae33d0b3493639ba893b87d377b032a73733
- SHA512 21b51d6fd2006ec45fd38e76ced7d50cfc393a05e084f4ec2e3d58edd2b6d498b0d149a4f8c681f190c89d67920abbde0e24a4d7787fa6b061980243f7bf1eaa
- SSDEEP 49152:Q1SKuDlgCx3lbTChxKCnFnQXBbrtgb/iQvu0UHOp:Q8DBgCx3l6hxvWbrtUTrUHOp
- TLSH T1C2B5E00133C4C861F67BA9B117E94E35787B74202736DDCB6B944D392BB0E4ADBA131A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory