2026-09-30_1de620b29b74724f51bf660f644e4c02_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry

General

Target
2026-09-30_1de620b29b74724f51bf660f644e4c02_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry
Size 240KB
Sample260930-qlpgca1dnb
SHA256 aef1935febf551cd36badc8d6a3afad2005e75af9883b9645b4765f47d283c8a
MD5 1de620b29b74724f51bf660f644e4c02
SHA1 84c63a696848a873c876ef2d5f5e635c2da52c6e
SHA512 e17ef2be556c2c732dd772b194d3a76dda6f29f3e8cbe0f2586d01c268d167fec6632ebef718f2dc239a0269474a8e2f78fb79d92200fa3e5caf8423c8f9b4a0
SSDEEP 3072:Cg2TyMj3tEcWMkc5tTBfZOVxtDH2g3zd3jceABCODJRCJbEknIbx0UgOJwzV2aPA:C7NqcWxc5tTBsJWKFGUOfCJbEHV0Q
TLSH
T15534DF19399089B2D07FD0BBC0D5BB28F77732321322D94B6B6CD6311D62766F6122DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_1de620b29b74724f51bf660f644e4c02_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry

File Explorer

2026-09-30_1de620b29b74724f51bf660f644e4c02_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry

.exe 240KB

2026-09-30_1de620b29b74724f51bf660f644e4c02_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry

IMPHASH 8ee1d6ac14557b768dcccdd9bb83afc0
SHA256 aef1935febf551cd36badc8d6a3afad2005e75af9883b9645b4765f47d283c8a
MD5 1de620b29b74724f51bf660f644e4c02
SHA1 84c63a696848a873c876ef2d5f5e635c2da52c6e
SHA512 e17ef2be556c2c732dd772b194d3a76dda6f29f3e8cbe0f2586d01c268d167fec6632ebef718f2dc239a0269474a8e2f78fb79d92200fa3e5caf8423c8f9b4a0
SSDEEP 3072:Cg2TyMj3tEcWMkc5tTBfZOVxtDH2g3zd3jceABCODJRCJbEknIbx0UgOJwzV2aPA:C7NqcWxc5tTBsJWKFGUOfCJbEHV0Q
TLSH
T15534DF19399089B2D07FD0BBC0D5BB28F77732321322D94B6B6CD6311D62766F6122DA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

38378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress GetModuleHandleW GetEnvironmentVariableW GetLastError CreateDirectoryW FindClose FindFirstFileW CloseHandle CreateFileW FreeLibrary OpenProcess WideCharToMultiByte TerminateProcess GetCommandLineW GetModuleFileNameW CreateProcessW lstrlenW GetTempPathW GetModuleHandleA GetOEMCP GetACP SetEndOfFile FlushFileBuffers SetStdHandle GetStringTypeW HeapAlloc GetProcessHeap VirtualAlloc VirtualProtect VirtualFree LoadLibraryA IsBadReadPtr HeapFree DeleteFileW GetTempFileNameW CopyFileW RtlUnwind InterlockedDecrement InterlockedIncrement RaiseException GetStartupInfoW GetVersion ExitProcess HeapReAlloc GetCurrentThreadId TlsSetValue TlsAlloc SetLastError TlsGetValue InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentProcess HeapSize HeapDestroy HeapCreate IsBadWritePtr SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsA MultiByteToWideChar FreeEnvironmentStringsW GetEnvironmentStringsW GetEnvironmentStrings GetCommandLineA SetHandleCount GetStdHandle GetFileType GetStartupInfoA WriteFile GetModuleFileNameA SetFilePointer ReadFile IsBadCodePtr LCMapStringA LCMapStringW GetCPInfo GetStringTypeA

shell32

CommandLineToArgvW

psapi

GetModuleFileNameExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_1de620b29b74724f51bf660f644e4c02_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry

kernel32

shell32

psapi

generic