General
- Target 2026-08-27_57af0a9f7e337844816bb1efc953871c_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry
- Size 3.4MB
- Sample260827-vv4pvayepc
- SHA256 029b5939a817ad38086533e8a789088df241c51b6ba5c869d8303bed830f4944
- MD5 57af0a9f7e337844816bb1efc953871c
- SHA1 f7e23f825983adcb7ff931d631c0b2711b3a3f29
- SHA512 c4afc9e3dc6a9551a4b94a3f04d0519cde270ba9e8814dad5c4dbae7639013506c388acab025166dcba20c20e0b266b7321a3efa6e165e258bf93bbf64791814
- SSDEEP 49152:6zueeFod/wDQfKK7wllllLZU3ylTiBJbTChxKCnFnQXBbrtgb/iQvu0UHOE:jXFodoDQfKK7IUVJ6hxvWbrtUTrUHOE
- TLSH T17FF5B0137641C43DE66681314DEF9E7451A679735B3285CBB788EE2C2EF09C2B633A42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-27_57af0a9f7e337844816bb1efc953871c_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-27_57af0a9f7e337844816bb1efc953871c_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-27_57af0a9f7e337844816bb1efc953871c_amadey_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry
- Size 3.4MB
- SHA256 029b5939a817ad38086533e8a789088df241c51b6ba5c869d8303bed830f4944
- MD5 57af0a9f7e337844816bb1efc953871c
- SHA1 f7e23f825983adcb7ff931d631c0b2711b3a3f29
- SHA512 c4afc9e3dc6a9551a4b94a3f04d0519cde270ba9e8814dad5c4dbae7639013506c388acab025166dcba20c20e0b266b7321a3efa6e165e258bf93bbf64791814
- SSDEEP 49152:6zueeFod/wDQfKK7wllllLZU3ylTiBJbTChxKCnFnQXBbrtgb/iQvu0UHOE:jXFodoDQfKK7IUVJ6hxvWbrtUTrUHOE
- TLSH T17FF5B0137641C43DE66681314DEF9E7451A679735B3285CBB788EE2C2EF09C2B633A42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory