General
- Target 2026-09-01_00d8c0ab38558b20d192ad07b8d4b35d_amadey_coinminer_darpapox_elex_jaku_nymaim_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 1.8MB
- Sample260901-2e7j5acj6y
- SHA256 9fee9342539e8cf3857c47039d7239197032ff2d0d749609abe2591dde78bbdd
- MD5 00d8c0ab38558b20d192ad07b8d4b35d
- SHA1 f11b9f5c77a0f1dfa91eb0f09d41f764831b9de4
- SHA512 6135cc91902c93a16dd1e61abaaf0127ba3b5c8d151f02224367b99ac47832f68dd143d272d50f453786ae8454f7c0b9bdf852c969391057a7d9f86a5e4367a6
- SSDEEP 24576:bq/XdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0O:bq1bTChxKCnFnQXBbrtgb/iQvu0UHOq
- TLSH T13A95EE122790CC61F31FC07643E19E79BA7369213733DC926A482A352BF2E9FE791156
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-01_00d8c0ab38558b20d192ad07b8d4b35d_amadey_coinminer_darpapox_elex_jaku_nymaim_redline-steal.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-01_00d8c0ab38558b20d192ad07b8d4b35d_amadey_coinminer_darpapox_elex_jaku_nymaim_redline-steal.exe
Resource
win11ltsc2024-20260709-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-01_00d8c0ab38558b20d192ad07b8d4b35d_amadey_coinminer_darpapox_elex_jaku_nymaim_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 1.8MB
- SHA256 9fee9342539e8cf3857c47039d7239197032ff2d0d749609abe2591dde78bbdd
- MD5 00d8c0ab38558b20d192ad07b8d4b35d
- SHA1 f11b9f5c77a0f1dfa91eb0f09d41f764831b9de4
- SHA512 6135cc91902c93a16dd1e61abaaf0127ba3b5c8d151f02224367b99ac47832f68dd143d272d50f453786ae8454f7c0b9bdf852c969391057a7d9f86a5e4367a6
- SSDEEP 24576:bq/XdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0O:bq1bTChxKCnFnQXBbrtgb/iQvu0UHOq
- TLSH T13A95EE122790CC61F31FC07643E19E79BA7369213733DC926A482A352BF2E9FE791156
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of file extensions in Explorer
-
Modifies visibility of hidden/system files in Explorer
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
3