General
- Target 2026-08-19_5599cfad4af8bee2c35c38726ebc55c7_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee_wannacry
- Size 2.2MB
- Sample260819-sxknmsxcmd
- SHA256 685e70fb5545315d10aa722d7fccf3cdea15d78b2efc76634eb0cc4d9b31b728
- MD5 5599cfad4af8bee2c35c38726ebc55c7
- SHA1 b2486631126f5a58cd421396ba45ca428afd4726
- SHA512 2081385485c52b6304005b4f5b90af605880bb215e183a5103ff30482d23183a4d053e47319eb9a06869e4ac52dfe4bd6fdbb21e044a994f28cb5af45e769500
- SSDEEP 49152:cCggshbTChxKCnFnQXBbrtgb/iQvu0UHOj:cCghh6hxvWbrtUTrUHOj
- TLSH T154B59DF51250C852F6AAC03902E13F32667FB9D027358B59ADD08EBD06F09F6966139F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_5599cfad4af8bee2c35c38726ebc55c7_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_5599cfad4af8bee2c35c38726ebc55c7_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_5599cfad4af8bee2c35c38726ebc55c7_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee_wannacry
- Size 2.2MB
- SHA256 685e70fb5545315d10aa722d7fccf3cdea15d78b2efc76634eb0cc4d9b31b728
- MD5 5599cfad4af8bee2c35c38726ebc55c7
- SHA1 b2486631126f5a58cd421396ba45ca428afd4726
- SHA512 2081385485c52b6304005b4f5b90af605880bb215e183a5103ff30482d23183a4d053e47319eb9a06869e4ac52dfe4bd6fdbb21e044a994f28cb5af45e769500
- SSDEEP 49152:cCggshbTChxKCnFnQXBbrtgb/iQvu0UHOj:cCghh6hxvWbrtUTrUHOj
- TLSH T154B59DF51250C852F6AAC03902E13F32667FB9D027358B59ADD08EBD06F09F6966139F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory