General
- Target 2026-05-19_137519b1b34eb9e2b80dbcb6665e4e4d_coinminer_darkgate_darpapox_elex_gcleaner_nymaim_rhadamanthys_wannacry
- Size 3.3MB
- Sample260519-w697faay6v
- SHA256 dfe2d85c4918c66271c4f0c34d0d584af95ce76e37011c05949ef8e93d11c26a
- MD5 137519b1b34eb9e2b80dbcb6665e4e4d
- SHA1 e21e7b8df6cef9b3fe2fe9f9bbde8bcfc9688b9e
- SHA512 8b2e6a99b141507fd33a4ff610f0af7de22980b862efaa9f771480062755aba381be93083000029e786bd5b6c5026c89c66db3c74d3fc72cf1890d8b845b259c
- SSDEEP 49152:y5/ab/29pV+ljpWAE9SjM8ffJbTChxKCnFnQXBbrtgb/iQvu0UHOP:y5ibiW3EwfJ6hxvWbrtUTrUHOP
- TLSH T1CEF5CF12B241CC32D66B16389DC79BF87A36BE202F3499873BB43D6C2F755427624297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-19_137519b1b34eb9e2b80dbcb6665e4e4d_coinminer_darkgate_darpapox_elex_gcleaner_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-19_137519b1b34eb9e2b80dbcb6665e4e4d_coinminer_darkgate_darpapox_elex_gcleaner_nymaim_rhadamanthys_wannacry.exe
Resource
win11-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-19_137519b1b34eb9e2b80dbcb6665e4e4d_coinminer_darkgate_darpapox_elex_gcleaner_nymaim_rhadamanthys_wannacry
- Size 3.3MB
- SHA256 dfe2d85c4918c66271c4f0c34d0d584af95ce76e37011c05949ef8e93d11c26a
- MD5 137519b1b34eb9e2b80dbcb6665e4e4d
- SHA1 e21e7b8df6cef9b3fe2fe9f9bbde8bcfc9688b9e
- SHA512 8b2e6a99b141507fd33a4ff610f0af7de22980b862efaa9f771480062755aba381be93083000029e786bd5b6c5026c89c66db3c74d3fc72cf1890d8b845b259c
- SSDEEP 49152:y5/ab/29pV+ljpWAE9SjM8ffJbTChxKCnFnQXBbrtgb/iQvu0UHOP:y5ibiW3EwfJ6hxvWbrtUTrUHOP
- TLSH T1CEF5CF12B241CC32D66B16389DC79BF87A36BE202F3499873BB43D6C2F755427624297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Drops file in System32 directory