General
- Target 2026-10-10_d7b04e4ce5453c9df2cebb20adca0898_amadey_coinminer_darpapox_elex_nymaim_remcos_rhadamanthys_smoke-loader_stop_wannacry
- Size 3.3MB
- Sample261011-a1rl9act2r
- SHA256 7cb2ffe659dbc15d711158767c5cdd2dfade2cd34bac0d7a6e17119eb5e7820f
- MD5 d7b04e4ce5453c9df2cebb20adca0898
- SHA1 7578e813c01c9f394b318d17f72b0a31b6e2ffe4
- SHA512 f0c9dc268a513beb941600ffd748159e64427d42258ec541a93a0b6cc87dff9703a5ceac6c6f035197d0a9f304ac960c790d7bcc3d4b2e33630fc9d58f2ba198
- SSDEEP 49152:h2XSju6nJjaTpsx4byLcou1bTChxKCnFnQXBbrtgb/iQvu0UHOL:zju6n8sx4bzp16hxvWbrtUTrUHOL
- TLSH T1B6F5E0103B94C4B1D75B74F106E19A3D6133AD212B36CACB6AB43A391BB26C7DE3524D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-10_d7b04e4ce5453c9df2cebb20adca0898_amadey_coinminer_darpapox_elex_nymaim_remcos_rhadamanthy.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-10_d7b04e4ce5453c9df2cebb20adca0898_amadey_coinminer_darpapox_elex_nymaim_remcos_rhadamanthy.exe
Resource
win11ltsc2024-20260911-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-10_d7b04e4ce5453c9df2cebb20adca0898_amadey_coinminer_darpapox_elex_nymaim_remcos_rhadamanthys_smoke-loader_stop_wannacry
- Size 3.3MB
- SHA256 7cb2ffe659dbc15d711158767c5cdd2dfade2cd34bac0d7a6e17119eb5e7820f
- MD5 d7b04e4ce5453c9df2cebb20adca0898
- SHA1 7578e813c01c9f394b318d17f72b0a31b6e2ffe4
- SHA512 f0c9dc268a513beb941600ffd748159e64427d42258ec541a93a0b6cc87dff9703a5ceac6c6f035197d0a9f304ac960c790d7bcc3d4b2e33630fc9d58f2ba198
- SSDEEP 49152:h2XSju6nJjaTpsx4byLcou1bTChxKCnFnQXBbrtgb/iQvu0UHOL:zju6n8sx4bzp16hxvWbrtUTrUHOL
- TLSH T1B6F5E0103B94C4B1D75B74F106E19A3D6133AD212B36CACB6AB43A391BB26C7DE3524D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory