General
- Target 2026-08-19_48304eb32c67e07fc624db5fd0bff26c_amadey_coinminer_darpapox_elex_nymaim_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 2.3MB
- Sample260819-s154razsgv
- SHA256 2f62e5eee6018313d0f0a53f2a5d3e9e336f294bdbb192879140af0f0e572f86
- MD5 48304eb32c67e07fc624db5fd0bff26c
- SHA1 f542b0b67daa9fa680cdb7e9cc522ce23f4ca3e3
- SHA512 8e2d884f9ffd7d8e49823ba95eb1992c18aed4138daaa2d8c29360cda7efc100aec4d08d019deeb019d016c7d38ff348ab3079a5d0de9f76422d85195ebea236
- SSDEEP 49152:fzf1LpbTChxKCnFnQXBbrtgb/iQvu0UHOt:LfFp6hxvWbrtUTrUHOt
- TLSH T1A0B5C02527E8C431F2BBD1704BE459367677B8613732CCAA1A80127D47F2D47EBA136A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_48304eb32c67e07fc624db5fd0bff26c_amadey_coinminer_darpapox_elex_nymaim_redline-stealer_re.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_48304eb32c67e07fc624db5fd0bff26c_amadey_coinminer_darpapox_elex_nymaim_redline-stealer_re.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_48304eb32c67e07fc624db5fd0bff26c_amadey_coinminer_darpapox_elex_nymaim_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 2.3MB
- SHA256 2f62e5eee6018313d0f0a53f2a5d3e9e336f294bdbb192879140af0f0e572f86
- MD5 48304eb32c67e07fc624db5fd0bff26c
- SHA1 f542b0b67daa9fa680cdb7e9cc522ce23f4ca3e3
- SHA512 8e2d884f9ffd7d8e49823ba95eb1992c18aed4138daaa2d8c29360cda7efc100aec4d08d019deeb019d016c7d38ff348ab3079a5d0de9f76422d85195ebea236
- SSDEEP 49152:fzf1LpbTChxKCnFnQXBbrtgb/iQvu0UHOt:LfFp6hxvWbrtUTrUHOt
- TLSH T1A0B5C02527E8C431F2BBD1704BE459367677B8613732CCAA1A80127D47F2D47EBA136A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory