2026-10-01_34ee9052f8a55c051de98abb09a4296c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry

General

Target
2026-10-01_34ee9052f8a55c051de98abb09a4296c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry
Size 244KB
Sample261002-vefm3sswcx
SHA256 67e17e3c8bfd44e3c780549c49c261df35829398bb655f6661778f1f5e080da1
MD5 34ee9052f8a55c051de98abb09a4296c
SHA1 b3cef821a52200fbbe3d9fb1bfd6866aa546f34e
SHA512 fcc63288a5ac40cdec9964eeb3ee66982c820282e429564570110359334775fb672069becabf5d6d203eb2b10701362dd617a6dba9af18536894d41df9147dbe
SSDEEP 6144:G7dqcWxc5tTBsJWKFGUOfC50XCX6Io3XIeISHLAjcw:OQpxc5tTG7FE6Se6vXISHucw
TLSH
T10534D01A3A9049F2D0BFD1B7C0D5BB38F77633321322994B6BAC96740D62776E6112C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_34ee9052f8a55c051de98abb09a4296c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry

File Explorer

2026-10-01_34ee9052f8a55c051de98abb09a4296c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry

.exe 244KB

2026-10-01_34ee9052f8a55c051de98abb09a4296c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry

IMPHASH 8ee1d6ac14557b768dcccdd9bb83afc0
SHA256 67e17e3c8bfd44e3c780549c49c261df35829398bb655f6661778f1f5e080da1
MD5 34ee9052f8a55c051de98abb09a4296c
SHA1 b3cef821a52200fbbe3d9fb1bfd6866aa546f34e
SHA512 fcc63288a5ac40cdec9964eeb3ee66982c820282e429564570110359334775fb672069becabf5d6d203eb2b10701362dd617a6dba9af18536894d41df9147dbe
SSDEEP 6144:G7dqcWxc5tTBsJWKFGUOfC50XCX6Io3XIeISHLAjcw:OQpxc5tTG7FE6Se6vXISHucw
TLSH
T10534D01A3A9049F2D0BFD1B7C0D5BB38F77633321322994B6BAC96740D62776E6112C6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

38378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress GetModuleHandleW GetEnvironmentVariableW GetLastError CreateDirectoryW FindClose FindFirstFileW CloseHandle CreateFileW FreeLibrary OpenProcess WideCharToMultiByte TerminateProcess GetCommandLineW GetModuleFileNameW CreateProcessW lstrlenW GetTempPathW GetModuleHandleA GetOEMCP GetACP SetEndOfFile FlushFileBuffers SetStdHandle GetStringTypeW HeapAlloc GetProcessHeap VirtualAlloc VirtualProtect VirtualFree LoadLibraryA IsBadReadPtr HeapFree DeleteFileW GetTempFileNameW CopyFileW RtlUnwind InterlockedDecrement InterlockedIncrement RaiseException GetStartupInfoW GetVersion ExitProcess HeapReAlloc GetCurrentThreadId TlsSetValue TlsAlloc SetLastError TlsGetValue InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentProcess HeapSize HeapDestroy HeapCreate IsBadWritePtr SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsA MultiByteToWideChar FreeEnvironmentStringsW GetEnvironmentStringsW GetEnvironmentStrings GetCommandLineA SetHandleCount GetStdHandle GetFileType GetStartupInfoA WriteFile GetModuleFileNameA SetFilePointer ReadFile IsBadCodePtr LCMapStringA LCMapStringW GetCPInfo GetStringTypeA

shell32

CommandLineToArgvW

psapi

GetModuleFileNameExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_34ee9052f8a55c051de98abb09a4296c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry

kernel32

shell32

psapi

generic