General
- Target 2026-10-23_ec292bad8c7eb566555697d0581ad808_coinminer_elex_glassworm_jaku_nymaim_rhadamanthys_stop_wannacry
- Size 1.9MB
- Sample261023-gsfncacc77
- SHA256 6498c689dc3ffcf9d729c78b8ac2ceca498c7231176bb1182aeab1f1e33d8983
- MD5 ec292bad8c7eb566555697d0581ad808
- SHA1 921dbeb0ce771de6b6a4f7bff109cd7bc88bb8bc
- SHA512 44056bba24a9db3d6865c1e7f89f0c6fd8964b0a35b69d5ef4ae18a0a381b582483e9701dbe4674d71ec2af47cd5b73496e20b262b47e0c49bfcb7473729dc4c
- SSDEEP 49152:Oqb00pr/FjovFGl+Jq8TjFJspDLoVMgdkt:OU00xlowowSFJspDLOMgdo
- TLSH T1A695E1B6BB81C8B2E556417151E3C3359E336E36433B89CB9BD419358E212E1AB3D7C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-23_ec292bad8c7eb566555697d0581ad808_coinminer_elex_glassworm_jaku_nymaim_rhadamanthys_stop_wannacry.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-23_ec292bad8c7eb566555697d0581ad808_coinminer_elex_glassworm_jaku_nymaim_rhadamanthys_stop_wannacry.exe
Resource
win11ltsc2024-20260911-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-23_ec292bad8c7eb566555697d0581ad808_coinminer_elex_glassworm_jaku_nymaim_rhadamanthys_stop_wannacry
- Size 1.9MB
- SHA256 6498c689dc3ffcf9d729c78b8ac2ceca498c7231176bb1182aeab1f1e33d8983
- MD5 ec292bad8c7eb566555697d0581ad808
- SHA1 921dbeb0ce771de6b6a4f7bff109cd7bc88bb8bc
- SHA512 44056bba24a9db3d6865c1e7f89f0c6fd8964b0a35b69d5ef4ae18a0a381b582483e9701dbe4674d71ec2af47cd5b73496e20b262b47e0c49bfcb7473729dc4c
- SSDEEP 49152:Oqb00pr/FjovFGl+Jq8TjFJspDLoVMgdkt:OU00xlowowSFJspDLOMgdo
- TLSH T1A695E1B6BB81C8B2E556417151E3C3359E336E36433B89CB9BD419358E212E1AB3D7C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application