General
- Target 2026-08-19_fada8cf3fc7efb9fdece63d2a1ec1c0c_coinminer_darpapox_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_wannacry
- Size 2.7MB
- Sample260819-rpl13acm2w
- SHA256 154066f014a531dbf1e7823ff8221ed9bea9b256d9da17746e055d0d152769bb
- MD5 fada8cf3fc7efb9fdece63d2a1ec1c0c
- SHA1 22230c2dc824e2867cb49d8c361c30f1e1413941
- SHA512 4d1f10fc662cd842618753415f6199727626853a895ef8fe66d1cab080a97a1631f2be70d58fd2b1bba4cd3dfacb227939fed6bc45aa0ba5316430538580ba8d
- SSDEEP 49152:NJ8LEOhUvHYqOSdxvJjdxvJ6FbTChxKCnFnQXBbrtgb/iQvu0UHOU:zyK4kLvJjLvJ6F6hxvWbrtUTrUHOU
- TLSH T15AD5F0012390CC61F36BD53657E5AE35B87728203B33DC5A5F880938ABF1D5BE391A66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_fada8cf3fc7efb9fdece63d2a1ec1c0c_coinminer_darpapox_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_fada8cf3fc7efb9fdece63d2a1ec1c0c_coinminer_darpapox_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260709-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_fada8cf3fc7efb9fdece63d2a1ec1c0c_coinminer_darpapox_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_wannacry
- Size 2.7MB
- SHA256 154066f014a531dbf1e7823ff8221ed9bea9b256d9da17746e055d0d152769bb
- MD5 fada8cf3fc7efb9fdece63d2a1ec1c0c
- SHA1 22230c2dc824e2867cb49d8c361c30f1e1413941
- SHA512 4d1f10fc662cd842618753415f6199727626853a895ef8fe66d1cab080a97a1631f2be70d58fd2b1bba4cd3dfacb227939fed6bc45aa0ba5316430538580ba8d
- SSDEEP 49152:NJ8LEOhUvHYqOSdxvJjdxvJ6FbTChxKCnFnQXBbrtgb/iQvu0UHOU:zyK4kLvJjLvJ6F6hxvWbrtUTrUHOU
- TLSH T15AD5F0012390CC61F36BD53657E5AE35B87728203B33DC5A5F880938ABF1D5BE391A66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory