General
- Target 2026-06-04_c2bf406a3d7d6db2c3a6044f63da08a8_amadey_coinminer_darkgate_darpapox_elex_hijackloader_luca-stealer_njrat_nymaim_rhadamanthys_wannacry
- Size 2.9MB
- Sample260604-rkmrssg13m
- SHA256 f985df5b614a258e4260ce90d73ff3f16247c997e0e885c34c611e0402df9161
- MD5 c2bf406a3d7d6db2c3a6044f63da08a8
- SHA1 d33f14e19777d585af099c624c083e2cd374bd47
- SHA512 eca300a54b7132f765dcdbde292062b50d494b8adc5d52095668c495cf3ca1190fcdcd79a75a09822d2c83441d2b2d1688f0dc8188d6066bacd17608daeec2d9
- SSDEEP 49152:MjtkkVAjEBd3cVStbTChxKCnFnQXBbrtgb/iQvu0UHOaYmLF:4tzIEBd3Lt6hxvWbrtUTrUHO2Z
- TLSH T126D5AD3132F29025D94EA033ABD95B3461E61D71DFF1CBC7C6052A691BB08C2B67A25F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-04_c2bf406a3d7d6db2c3a6044f63da08a8_amadey_coinminer_darkgate_darpapox_elex_hijackloader_luc.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_c2bf406a3d7d6db2c3a6044f63da08a8_amadey_coinminer_darkgate_darpapox_elex_hijackloader_luc.exe
Resource
win11-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-04_c2bf406a3d7d6db2c3a6044f63da08a8_amadey_coinminer_darkgate_darpapox_elex_hijackloader_luca-stealer_njrat_nymaim_rhadamanthys_wannacry
- Size 2.9MB
- SHA256 f985df5b614a258e4260ce90d73ff3f16247c997e0e885c34c611e0402df9161
- MD5 c2bf406a3d7d6db2c3a6044f63da08a8
- SHA1 d33f14e19777d585af099c624c083e2cd374bd47
- SHA512 eca300a54b7132f765dcdbde292062b50d494b8adc5d52095668c495cf3ca1190fcdcd79a75a09822d2c83441d2b2d1688f0dc8188d6066bacd17608daeec2d9
- SSDEEP 49152:MjtkkVAjEBd3cVStbTChxKCnFnQXBbrtgb/iQvu0UHOaYmLF:4tzIEBd3Lt6hxvWbrtUTrUHO2Z
- TLSH T126D5AD3132F29025D94EA033ABD95B3461E61D71DFF1CBC7C6052A691BB08C2B67A25F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Drops file in System32 directory