General
- Target 2026-06-01_4d96fd388c8315b31d22da52da5299da_coinminer_darkgate_darpapox_elex_nymaim_rhadamanthys_smoke-loader_wannacry
- Size 3.7MB
- Sample260601-sj5rnagy6s
- SHA256 fec4d77f0be762eae188d6add495c987ff11653c3f8e988e6fdcf2966104adbf
- MD5 4d96fd388c8315b31d22da52da5299da
- SHA1 0e05d6123bfb6951aba4e2e618f187f7978fc4a4
- SHA512 72bc86ca6f116409fe8fe2f3591ea9daecdd6e302173a942c1bea68260884d896d21d90bc59e1df31c242b42ef3364f38e859afd0e678328dad6d1052cb7cf03
- SSDEEP 98304:4ApWIGOTW9Y3OqkWXNc3lfFmtH8rIyBcgD5jz56hxvWbrtUTrUHO/:L6UXN2Fc8rIy3jz8x+NcIO/
- TLSH T17E06E1213790C47AD237623156CAA7B8B2B7AD305F72858B17843E396F70453DA6836F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-01_4d96fd388c8315b31d22da52da5299da_coinminer_darkgate_darpapox_elex_nymaim_rhadamanthys_smoke-loader_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-01_4d96fd388c8315b31d22da52da5299da_coinminer_darkgate_darpapox_elex_nymaim_rhadamanthys_smoke-loader_wannacry.exe
Resource
win11-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-01_4d96fd388c8315b31d22da52da5299da_coinminer_darkgate_darpapox_elex_nymaim_rhadamanthys_smoke-loader_wannacry
- Size 3.7MB
- SHA256 fec4d77f0be762eae188d6add495c987ff11653c3f8e988e6fdcf2966104adbf
- MD5 4d96fd388c8315b31d22da52da5299da
- SHA1 0e05d6123bfb6951aba4e2e618f187f7978fc4a4
- SHA512 72bc86ca6f116409fe8fe2f3591ea9daecdd6e302173a942c1bea68260884d896d21d90bc59e1df31c242b42ef3364f38e859afd0e678328dad6d1052cb7cf03
- SSDEEP 98304:4ApWIGOTW9Y3OqkWXNc3lfFmtH8rIyBcgD5jz56hxvWbrtUTrUHO/:L6UXN2Fc8rIy3jz8x+NcIO/
- TLSH T17E06E1213790C47AD237623156CAA7B8B2B7AD305F72858B17843E396F70453DA6836F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory