General
- Target 2026-08-20_730858402278c3d8744d35bea510f75e_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke-loader_wannacry
- Size 2.2MB
- Sample260820-sp5nvas1fz
- SHA256 db17e91f802b8b1cb990f2ae275cd63c1738272a72c0059a22ff55705afc057b
- MD5 730858402278c3d8744d35bea510f75e
- SHA1 3e3864bc7e4efc2a13779378fd213325ef3aa66c
- SHA512 3a0cee3130b2e7f6df3d9a78bdd82f125cb8e5b673a37fc03c165a6f52dfe721af07d7f7464f411aff363a3eacd51f092bf6c7335c010441b142bc848084c2a7
- SSDEEP 49152:aSMNyK6nAwTYkrhRqlNvREqE6rn03dl2AsBbTChxKCnFnQXBbrtgb/iQvu0UHOt:aSMcK6nAwTYkrhRqlNvREqE6rn03dl28
- TLSH T1FCB5EF181300CCA1F75FD13593D2AE7575BB2C3027B2C8959E8434B55BF2EAEE3A8259
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_730858402278c3d8744d35bea510f75e_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke-loader_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_730858402278c3d8744d35bea510f75e_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke-loader_wannacry.exe
Resource
win11ltsc2024-20260710-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_730858402278c3d8744d35bea510f75e_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_smoke-loader_wannacry
- Size 2.2MB
- SHA256 db17e91f802b8b1cb990f2ae275cd63c1738272a72c0059a22ff55705afc057b
- MD5 730858402278c3d8744d35bea510f75e
- SHA1 3e3864bc7e4efc2a13779378fd213325ef3aa66c
- SHA512 3a0cee3130b2e7f6df3d9a78bdd82f125cb8e5b673a37fc03c165a6f52dfe721af07d7f7464f411aff363a3eacd51f092bf6c7335c010441b142bc848084c2a7
- SSDEEP 49152:aSMNyK6nAwTYkrhRqlNvREqE6rn03dl2AsBbTChxKCnFnQXBbrtgb/iQvu0UHOt:aSMcK6nAwTYkrhRqlNvREqE6rn03dl28
- TLSH T1FCB5EF181300CCA1F75FD13593D2AE7575BB2C3027B2C8959E8434B55BF2EAEE3A8259
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory