General
- Target 2026-11-06_f8218074e9da059ba7de8ed19539cc2f_coinminer_darpapox_elex_emotet_icedid_jaku_nymaim_rhadamanthys_wannacry
- Size 2.1MB
- Sample261107-w7pxwset3s
- SHA256 ff2d5841c5e2458c138b3c63c208c010bc4631ea9674997bb02962a4d765f8b0
- MD5 f8218074e9da059ba7de8ed19539cc2f
- SHA1 207132cb8c54cda39bca0b9e8f077e35fcb403aa
- SHA512 d7342d8e2e27196edc8e76a1efbc0adabf4c19a0474f977033b474ef644a76c7daf2ac89914355407e763a276e1ac609504ddd88dac34cfa7f9893d1a6013457
- SSDEEP 49152:cIrK9v3d84T1NNbTChxKCnFnQXBbrtgb/iQvu0UHO9W:cIru3vDN6hxvWbrtUTrUHO9W
- TLSH T13FA5E0093390CE72F35BD13347D55E75767BB8202B33C9832A44263D9AF1E8AE7A5252
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-06_f8218074e9da059ba7de8ed19539cc2f_coinminer_darpapox_elex_emotet_icedid_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260911-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-06_f8218074e9da059ba7de8ed19539cc2f_coinminer_darpapox_elex_emotet_icedid_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260911-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-06_f8218074e9da059ba7de8ed19539cc2f_coinminer_darpapox_elex_emotet_icedid_jaku_nymaim_rhadamanthys_wannacry
- Size 2.1MB
- SHA256 ff2d5841c5e2458c138b3c63c208c010bc4631ea9674997bb02962a4d765f8b0
- MD5 f8218074e9da059ba7de8ed19539cc2f
- SHA1 207132cb8c54cda39bca0b9e8f077e35fcb403aa
- SHA512 d7342d8e2e27196edc8e76a1efbc0adabf4c19a0474f977033b474ef644a76c7daf2ac89914355407e763a276e1ac609504ddd88dac34cfa7f9893d1a6013457
- SSDEEP 49152:cIrK9v3d84T1NNbTChxKCnFnQXBbrtgb/iQvu0UHO9W:cIru3vDN6hxvWbrtUTrUHO9W
- TLSH T13FA5E0093390CE72F35BD13347D55E75767BB8202B33C9832A44263D9AF1E8AE7A5252
- MD5 SHA1 SHA512 SSDEEP TLSH
Modifies firewall policy service
Drops file in Drivers directory
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
MITRE ATT&CK Enterprise v16
Privilege Escalation
Create or Modify System Process
1Windows Service
1Process Injection
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Process Injection
1