General
- Target 2026-08-19_4ebd996247243ff660e8275b0bf779bf_amadey_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_smoke-loader_stealc_wannacry
- Size 2.1MB
- Sample260819-szd9msxcnc
- SHA256 b0c076d80c9ab1785b6658838be22ecf30992fa7f973f4216bad3f9e424dcae2
- MD5 4ebd996247243ff660e8275b0bf779bf
- SHA1 f767541dc016bbb541ce0c11da412de9e689ee9b
- SHA512 3fd040c6bded8ce978b7728f7ea7594529e2898b7a9123ac0a4741b921e0d3ddc7278a8f6d1ea939872976ab8838ac0d7af7e94d5a8e379a5f5d082a5fb86eed
- SSDEEP 49152:3bqcMLhYp9bTChxKCnFnQXBbrtgb/iQvu0UHO4:3bqcMLY96hxvWbrtUTrUHO4
- TLSH T1F0A5DF1127D0CD21F2AFE67156F45E35B97778223B32C98B6B4801391BF1E8AD7A1362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_4ebd996247243ff660e8275b0bf779bf_amadey_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_4ebd996247243ff660e8275b0bf779bf_amadey_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_4ebd996247243ff660e8275b0bf779bf_amadey_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_smoke-loader_stealc_wannacry
- Size 2.1MB
- SHA256 b0c076d80c9ab1785b6658838be22ecf30992fa7f973f4216bad3f9e424dcae2
- MD5 4ebd996247243ff660e8275b0bf779bf
- SHA1 f767541dc016bbb541ce0c11da412de9e689ee9b
- SHA512 3fd040c6bded8ce978b7728f7ea7594529e2898b7a9123ac0a4741b921e0d3ddc7278a8f6d1ea939872976ab8838ac0d7af7e94d5a8e379a5f5d082a5fb86eed
- SSDEEP 49152:3bqcMLhYp9bTChxKCnFnQXBbrtgb/iQvu0UHO4:3bqcMLY96hxvWbrtUTrUHO4
- TLSH T1F0A5DF1127D0CD21F2AFE67156F45E35B97778223B32C98B6B4801391BF1E8AD7A1362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory