General
- Target 2026-10-10_ca4b47058a337e79f49e1ca9a96679b5_coinminer_darpapox_elex_emotet_nymaim_rhadamanthys_wannacry
- Size 2.3MB
- Sample261011-csdrjad13y
- SHA256 5dee4a27dc062b1e6bdb11404d3b3a1165111f9ae3a3fceee5b04fb0a8ec4567
- MD5 ca4b47058a337e79f49e1ca9a96679b5
- SHA1 510ff584b33ad8db66c5e8cd3bf42f5d09f4b021
- SHA512 be78b2b2bc9ad40df1fd9877683d6eb9c9b6b669790705dfa93549009bab28f5d22810511c4ba821c7db1729e7f2bc01173e18f098eec24ced9418a9f5b07798
- SSDEEP 49152:y3AaiT/ekapbTChxKCnFnQXBbrtgb/iQvu0UHO4:y3Nfp6hxvWbrtUTrUHO4
- TLSH T190B5F0112790CCA2F32FC03247D55F79B6B369202B33CC866F8866785BF2D4AE7A5651
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-10_ca4b47058a337e79f49e1ca9a96679b5_coinminer_darpapox_elex_emotet_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260911-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-10_ca4b47058a337e79f49e1ca9a96679b5_coinminer_darpapox_elex_emotet_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260911-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-10_ca4b47058a337e79f49e1ca9a96679b5_coinminer_darpapox_elex_emotet_nymaim_rhadamanthys_wannacry
- Size 2.3MB
- SHA256 5dee4a27dc062b1e6bdb11404d3b3a1165111f9ae3a3fceee5b04fb0a8ec4567
- MD5 ca4b47058a337e79f49e1ca9a96679b5
- SHA1 510ff584b33ad8db66c5e8cd3bf42f5d09f4b021
- SHA512 be78b2b2bc9ad40df1fd9877683d6eb9c9b6b669790705dfa93549009bab28f5d22810511c4ba821c7db1729e7f2bc01173e18f098eec24ced9418a9f5b07798
- SSDEEP 49152:y3AaiT/ekapbTChxKCnFnQXBbrtgb/iQvu0UHO4:y3Nfp6hxvWbrtUTrUHO4
- TLSH T190B5F0112790CCA2F32FC03247D55F79B6B369202B33CC866F8866785BF2D4AE7A5651
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory