General
- Target 2026-08-19_6d53b643f4f71acf72f3534f98284d81_amadey_coinminer_darpapox_elex_hijackloader_jaku_nymaim_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 1.9MB
- Sample260819-sp43badj8w
- SHA256 8c4edd84321f605ae78b9af1ce8b5d8ba31c84d4e589683dd66c0bb057b2132a
- MD5 6d53b643f4f71acf72f3534f98284d81
- SHA1 35245cdd1fca3ef2b57d8cf52f41959ce8ee6a9c
- SHA512 b1ecea9c7cfc03d2a6db484ca79f1cf6a206bc887aeaf07a2960f6cc0447c9aec55597c5477df03019cdf874dbe7dca11e923c57a3801d54cd8f0ce354246432
- SSDEEP 24576:1jF3uO/3XdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4of:1jJdbTChxKCnFnQXBbrtgb/iQvu0UHOH
- TLSH T10795CD132640CC21E66BC0724EDF5E79B57369233732C8866A88DD712FF1A9AF3A3155
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_6d53b643f4f71acf72f3534f98284d81_amadey_coinminer_darpapox_elex_hijackloader_jaku_nymaim_.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_6d53b643f4f71acf72f3534f98284d81_amadey_coinminer_darpapox_elex_hijackloader_jaku_nymaim_.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_6d53b643f4f71acf72f3534f98284d81_amadey_coinminer_darpapox_elex_hijackloader_jaku_nymaim_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 1.9MB
- SHA256 8c4edd84321f605ae78b9af1ce8b5d8ba31c84d4e589683dd66c0bb057b2132a
- MD5 6d53b643f4f71acf72f3534f98284d81
- SHA1 35245cdd1fca3ef2b57d8cf52f41959ce8ee6a9c
- SHA512 b1ecea9c7cfc03d2a6db484ca79f1cf6a206bc887aeaf07a2960f6cc0447c9aec55597c5477df03019cdf874dbe7dca11e923c57a3801d54cd8f0ce354246432
- SSDEEP 24576:1jF3uO/3XdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4of:1jJdbTChxKCnFnQXBbrtgb/iQvu0UHOH
- TLSH T10795CD132640CC21E66BC0724EDF5E79B57369233732C8866A88DD712FF1A9AF3A3155
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory