General
- Target 2026-06-28_7b0ec5c2fbee256b3afda110cd5044e5_amadey_coinminer_darkgate_darpapox_elex_nymaim_remcos_rhadamanthys_smoke-loader_wannacry
- Size 2.3MB
- Sample260628-1a8e7afs5k
- SHA256 2cb000cd31a7c18d3366e99636b941d8465c9872d6cbca1a6f47a76a8686c16d
- MD5 7b0ec5c2fbee256b3afda110cd5044e5
- SHA1 2bc0502723b2110a4ddc71eb1b826f3c64e17a10
- SHA512 d3f7383b9d034640714cd74466fc44d4b4d0566b900044ba5e2c6de0426764ae11883dc30297ab32cd0d02a80ffba046908fec9c30f96725f3192926065ee942
- SSDEEP 49152:ClIyoKIXITsatbTChxKCnFnQXBbrtgb/iQvu0UHOkZQB:CeFDEnt6hxvWbrtUTrUHOkZy
- TLSH T1E3B5E011B352D871E65FC0F106E8AE3A743768203732CED7ABC416351AF1AD6EBB1169
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-28_7b0ec5c2fbee256b3afda110cd5044e5_amadey_coinminer_darkgate_darpapox_elex_nymaim_remcos_rh.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_7b0ec5c2fbee256b3afda110cd5044e5_amadey_coinminer_darkgate_darpapox_elex_nymaim_remcos_rh.exe
Resource
win11ltsc2024-20260618-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-28_7b0ec5c2fbee256b3afda110cd5044e5_amadey_coinminer_darkgate_darpapox_elex_nymaim_remcos_rhadamanthys_smoke-loader_wannacry
- Size 2.3MB
- SHA256 2cb000cd31a7c18d3366e99636b941d8465c9872d6cbca1a6f47a76a8686c16d
- MD5 7b0ec5c2fbee256b3afda110cd5044e5
- SHA1 2bc0502723b2110a4ddc71eb1b826f3c64e17a10
- SHA512 d3f7383b9d034640714cd74466fc44d4b4d0566b900044ba5e2c6de0426764ae11883dc30297ab32cd0d02a80ffba046908fec9c30f96725f3192926065ee942
- SSDEEP 49152:ClIyoKIXITsatbTChxKCnFnQXBbrtgb/iQvu0UHOkZQB:CeFDEnt6hxvWbrtUTrUHOkZy
- TLSH T1E3B5E011B352D871E65FC0F106E8AE3A743768203732CED7ABC416351AF1AD6EBB1169
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory