f251222b80668d77dda58e41ac03d9bbc30f4b2f5ea3c3a9721c494a384907d2

General

Target
2026-08-28_dce79293f042a09cbd331138190d8570_chinachopper_coinminer_elex_rhadamanthys_stop
Size 239KB
Sample260828-jebtcat1ew
SHA256 f251222b80668d77dda58e41ac03d9bbc30f4b2f5ea3c3a9721c494a384907d2
MD5 dce79293f042a09cbd331138190d8570
SHA1 3cb4a502ad7a6a05ca16bacfeff9a2b68b89c13a
SHA512 63f074e016a830f00dc1ac564e420de84499879616cf3ad73e168d74ed32cc0bb1e436fc8cda20dbb24935f7d55521452f3fa2f83b5029b6269574c4111152bc
SSDEEP 3072:PiVj/n1Y4p4gSVNmbQ8Ki30yyIwg4uh1os:KVj/9Jn30YSSos
TLSH
T11D349D03F7588036C052433545A9A7465B3EFEA88BB1059276E9728E3E727C19337BDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-28_dce79293f042a09cbd331138190d8570_chinachopper_coinminer_elex_rhadamanthys_stop
- Size 239KB
- SHA256 f251222b80668d77dda58e41ac03d9bbc30f4b2f5ea3c3a9721c494a384907d2
- MD5 dce79293f042a09cbd331138190d8570
- SHA1 3cb4a502ad7a6a05ca16bacfeff9a2b68b89c13a
- SHA512 63f074e016a830f00dc1ac564e420de84499879616cf3ad73e168d74ed32cc0bb1e436fc8cda20dbb24935f7d55521452f3fa2f83b5029b6269574c4111152bc
- SSDEEP 3072:PiVj/n1Y4p4gSVNmbQ8Ki30yyIwg4uh1os:KVj/9Jn30YSSos
- TLSH
  T11D349D03F7588036C052433545A9A7465B3EFEA88BB1059276E9728E3E727C19337BDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery ransomware upx
- UPX dump on OEP (original entry point)
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2