General
- Target 2026-08-19_93354a4e17915dc1517c886f38d5102b_amadey_coinminer_darpapox_elex_glassworm_nymaim_rhadamanthys_smoke-loader_wannacry
- Size 3.3MB
- Sample260819-sdx5mayxgv
- SHA256 5a1b89a33b65fd025be0953d4476a016176942729703428d936d1768026b54ae
- MD5 93354a4e17915dc1517c886f38d5102b
- SHA1 e7bdc0f51018834ea0b2d17394feb1f0871aca7f
- SHA512 136908f3c2f356ac054f82440dfe65f13877a4af235017f91d994333101a4455794766e0e0d5165da1c6b7a6d931c99ab1fa7c87bece9669e919e5c53ba749c9
- SSDEEP 98304:cxruFH2ryQA6F4LysmXnwssEKGhba6Uxwq5x6hxvWbrtUTrUHO5:iruF98nsGM6Uxwq50x+NcIO5
- TLSH T106F5D1203B90C876D367613186CA5779B2B796303B7596872BD01E382FB0D93DA1C76B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_93354a4e17915dc1517c886f38d5102b_amadey_coinminer_darpapox_elex_glassworm_nymaim_rhadaman.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_93354a4e17915dc1517c886f38d5102b_amadey_coinminer_darpapox_elex_glassworm_nymaim_rhadaman.exe
Resource
win11ltsc2024-20260710-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_93354a4e17915dc1517c886f38d5102b_amadey_coinminer_darpapox_elex_glassworm_nymaim_rhadamanthys_smoke-loader_wannacry
- Size 3.3MB
- SHA256 5a1b89a33b65fd025be0953d4476a016176942729703428d936d1768026b54ae
- MD5 93354a4e17915dc1517c886f38d5102b
- SHA1 e7bdc0f51018834ea0b2d17394feb1f0871aca7f
- SHA512 136908f3c2f356ac054f82440dfe65f13877a4af235017f91d994333101a4455794766e0e0d5165da1c6b7a6d931c99ab1fa7c87bece9669e919e5c53ba749c9
- SSDEEP 98304:cxruFH2ryQA6F4LysmXnwssEKGhba6Uxwq5x6hxvWbrtUTrUHO5:iruF98nsGM6Uxwq50x+NcIO5
- TLSH T106F5D1203B90C876D367613186CA5779B2B796303B7596872BD01E382FB0D93DA1C76B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory