Open-source atomic malware analysis

Analyze another

2026-04-25_4a5b57c688def380774cb073f3e9e9b6_coinminer_elex_wannacry

PE
Verdict: SUSPICIOUS
SHA256: 3a30044c990b5ed22704803031e4a5cf297b533729ef9ae413e75ab673a6afd0
Mal-ecule
O(Eu)H(Os₂)
Size 195.5 KB download
First seen 118 days ago
Analyzed 98 days ago
Ecosystem vxunderground-inthewild

Objectives

suspicious severity, 75% confident.
exfiltration/dns Long subdomain encoding pattern

Micro-behaviors

notable severity, 70% confident.
os/privilege runas privilege elevation string
notable severity, 90% confident.
os/sysinfo Query disk free space
baseline severity, 90% confident.
dylib Windows GetProcAddress API string
baseline severity, 90% confident.
fs/file CreateFile API string reference
baseline severity, 66% confident.
fs/temp Look up temp directory via GetTempPath
baseline severity, 90% confident.
os/compat Disable WoW64 filesystem redirection
baseline severity, 100% confident.
os/module Reference to USER32.dll
baseline severity, 90% confident.
os/sysinfo/platform Query Windows version info
baseline severity, 90% confident.
process/create Close handle
baseline severity, 90% confident.
process/inject/runtime ResumeThread API reference
baseline severity, 70% confident.
process/threading CreateThread API name reference
baseline severity, 88% confident.
ui/window/manage Call window procedure

Metadata

baseline severity, 100% confident.
binary PE has RT_GROUP_ICON in resources list
baseline severity, 100% confident.
binary/metrics Binary has 1000 or more strings
baseline severity, 95% confident.
binary/section UPX packed section name
baseline severity, 100% confident.
build Depends on Common-Controls v6
baseline severity, 70% confident.
package PE CompanyName metadata field

anti-static

hostile severity, 100% confident.
packer/upx UPX decompression failed: IO error: No such file or directory (os error 2)
suspicious severity, 100% confident.
packer Binary contains a UPX packing marker

20 of 45 traits shown

Identity

SHA-256 3a30044c990b5ed22704803031e4a5cf297b533729ef9ae413e75ab673a6afd0
Filename 2026-04-25_4a5b57c688def380774cb073f3e9e9b6_coinminer_elex_wannacry

Origin

Source harvest
Feed datasets
Ecosystem vxunderground-inthewild

Timeline

First seen 6 May 2026 08:30 UTC
First analyzed 7 May 2026 08:08 UTC
Last analyzed 25 May 2026 16:05 UTC
Last updated 25 May 2026 16:05 UTC

Labeling

Label bad
Label source harvest
Traits version cf883