General
- Target 2026-04-20_631eabbdf5d3613d03520d6fd09a6797_amadey_coinminer_darkgate_darpapox_elex_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader_wannacry
- Size 5.8MB
- Sample260420-rawa7ags7w
- SHA256 7e72b87824ea6e31f442ed8ba3c394e7cbb405bd4a167839ea8f02ff3856a6b4
- MD5 631eabbdf5d3613d03520d6fd09a6797
- SHA1 db6cfb03fe31b7b422f580bf707944aecd208788
- SHA512 106fdac94c0e9a24ea3121f6866f1739f183670846de70af250666fa1569121b9b24e3d94ade440d1daf84cca7be4ef8c8a202975289067da1e3d5d54c0eb7b4
- SSDEEP 98304:Pr1lgMvFMpuFGhqJudUCly3jIK4JXIQjUFLOAkGkzdnEVomFHKnPdZ6hxvWbrtUA:D1lVvFMQF0y8K4JXIKUFLOyomFHKnPdn
- TLSH T12F56D1113EE8CC67E16702718AD8F67C717FBEB4273E80976248772D7A30B925A15227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-20_631eabbdf5d3613d03520d6fd09a6797_amadey_coinminer_darkgate_darpapox_elex_icedid_luca-stea.exe
Resource
win10v2004-20260130-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-20_631eabbdf5d3613d03520d6fd09a6797_amadey_coinminer_darkgate_darpapox_elex_icedid_luca-stea.exe
Resource
win11-20260130-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-20_631eabbdf5d3613d03520d6fd09a6797_amadey_coinminer_darkgate_darpapox_elex_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader_wannacry
- Size 5.8MB
- SHA256 7e72b87824ea6e31f442ed8ba3c394e7cbb405bd4a167839ea8f02ff3856a6b4
- MD5 631eabbdf5d3613d03520d6fd09a6797
- SHA1 db6cfb03fe31b7b422f580bf707944aecd208788
- SHA512 106fdac94c0e9a24ea3121f6866f1739f183670846de70af250666fa1569121b9b24e3d94ade440d1daf84cca7be4ef8c8a202975289067da1e3d5d54c0eb7b4
- SSDEEP 98304:Pr1lgMvFMpuFGhqJudUCly3jIK4JXIQjUFLOAkGkzdnEVomFHKnPdZ6hxvWbrtUA:D1lVvFMQF0y8K4JXIKUFLOyomFHKnPdn
- TLSH T12F56D1113EE8CC67E16702718AD8F67C717FBEB4273E80976248772D7A30B925A15227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Drops file in System32 directory