General
- Target 2026-08-19_104cb37ef44e825908022dde9bd6d0e8_coinminer_darpapox_elex_nymaim_remcos_rhadamanthys_stop_wannacry
- Size 2.6MB
- Sample260819-th885azxdv
- SHA256 bd002b78fe3cdf1b8275c90fa26f503c95957ffc0f2af1a83726ba13d384c60e
- MD5 104cb37ef44e825908022dde9bd6d0e8
- SHA1 1cac489d58f07fc67e773c2af839468eb845aedc
- SHA512 bd48efa28be1a8fc113247864827ee9b8c66e8c4a7a93033c30c80e44adc249fd263586790b935c671cef27a38482995479832ce7906f903ef32a2722f9f6253
- SSDEEP 49152:R0O2ac3AtbTChxKCnFnQXBbrtgb/iQvu0UHO7:naQt6hxvWbrtUTrUHO7
- TLSH T176D5E010E795C961F66FE27106F01E38363779413B72C98F5B8839348BF2A8BDAA1715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_104cb37ef44e825908022dde9bd6d0e8_coinminer_darpapox_elex_nymaim_remcos_rhadamanthys_stop_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_104cb37ef44e825908022dde9bd6d0e8_coinminer_darpapox_elex_nymaim_remcos_rhadamanthys_stop_wannacry.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_104cb37ef44e825908022dde9bd6d0e8_coinminer_darpapox_elex_nymaim_remcos_rhadamanthys_stop_wannacry
- Size 2.6MB
- SHA256 bd002b78fe3cdf1b8275c90fa26f503c95957ffc0f2af1a83726ba13d384c60e
- MD5 104cb37ef44e825908022dde9bd6d0e8
- SHA1 1cac489d58f07fc67e773c2af839468eb845aedc
- SHA512 bd48efa28be1a8fc113247864827ee9b8c66e8c4a7a93033c30c80e44adc249fd263586790b935c671cef27a38482995479832ce7906f903ef32a2722f9f6253
- SSDEEP 49152:R0O2ac3AtbTChxKCnFnQXBbrtgb/iQvu0UHO7:naQt6hxvWbrtUTrUHO7
- TLSH T176D5E010E795C961F66FE27106F01E38363779413B72C98F5B8839348BF2A8BDAA1715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory