General
- Target 2026-05-10_7bcbfc1788b004204dd1653071ecfb68_coinminer_darkgate_darpapox_elex_gcleaner_nymaim_rhadamanthys_wannacry
- Size 2.7MB
- Sample260510-1eecxae13y
- SHA256 c9bd3a46e1f4882db82f4a01824784625b05d147a892d32cb0b83eb8363344d9
- MD5 7bcbfc1788b004204dd1653071ecfb68
- SHA1 e30b622e0ab0117785425f3342e1e33c917586a2
- SHA512 3bc3e31a1d2c0d2ec4f8670a381cd8346ea9d69cecaed8fbd5689051361a1d5e405cc811f5e176ad17fa890328e37fdfd3db38da7f0b2fbdcc5624ed627a4329
- SSDEEP 49152:iZXkLAJp1LDi5IhNHTBbTChxKCnFnQXBbrtgb/iQvu0UHOW:iRB6hxvWbrtUTrUHOW
- TLSH T109D5E021B251C836E13742704EDB9BB5753BBE212B21D9473BE07E3C5FB1A41BA16287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-10_7bcbfc1788b004204dd1653071ecfb68_coinminer_darkgate_darpapox_elex_gcleaner_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260130-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-10_7bcbfc1788b004204dd1653071ecfb68_coinminer_darkgate_darpapox_elex_gcleaner_nymaim_rhadamanthys_wannacry.exe
Resource
win11-20260130-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-10_7bcbfc1788b004204dd1653071ecfb68_coinminer_darkgate_darpapox_elex_gcleaner_nymaim_rhadamanthys_wannacry
- Size 2.7MB
- SHA256 c9bd3a46e1f4882db82f4a01824784625b05d147a892d32cb0b83eb8363344d9
- MD5 7bcbfc1788b004204dd1653071ecfb68
- SHA1 e30b622e0ab0117785425f3342e1e33c917586a2
- SHA512 3bc3e31a1d2c0d2ec4f8670a381cd8346ea9d69cecaed8fbd5689051361a1d5e405cc811f5e176ad17fa890328e37fdfd3db38da7f0b2fbdcc5624ed627a4329
- SSDEEP 49152:iZXkLAJp1LDi5IhNHTBbTChxKCnFnQXBbrtgb/iQvu0UHOW:iRB6hxvWbrtUTrUHOW
- TLSH T109D5E021B251C836E13742704EDB9BB5753BBE212B21D9473BE07E3C5FB1A41BA16287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory