General
- Target 2026-06-28_45e7f0821215b69a9cc2a519969650d6_coinminer_darkgate_darpapox_elex_nymaim_remcos_rhadamanthys_wannacry
- Size 4.3MB
- Sample260628-2xp3ssgx7k
- SHA256 bf7079e989fecc1d49cf7750878f4fd5c3b3be14ec726618ea81eac867597911
- MD5 45e7f0821215b69a9cc2a519969650d6
- SHA1 ce178f7fbafcaee69ece2993a326b2bbf2826f66
- SHA512 2498a020a90db61e5e533e049351b95ef1d0733951b2e434668f215101ea1a7c63ebed59b7381a173df3347e96a78314444f11c6f57e15b64035c410578e9c17
- SSDEEP 98304:8IwM4BeFgc22QmCp2hbN++fZnEjcN6iR9+6nVisNP7h6hxvWbrtUTrUHOkZ8:0jyvQUEQsa9+6nVfP7Ex+NcIOk2
- TLSH T1FA269DF0A62DC061D932113C4BA5623F6167BF105F258F839942393A1DFFAB9472E16E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-28_45e7f0821215b69a9cc2a519969650d6_coinminer_darkgate_darpapox_elex_nymaim_remcos_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_45e7f0821215b69a9cc2a519969650d6_coinminer_darkgate_darpapox_elex_nymaim_remcos_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260617-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-28_45e7f0821215b69a9cc2a519969650d6_coinminer_darkgate_darpapox_elex_nymaim_remcos_rhadamanthys_wannacry
- Size 4.3MB
- SHA256 bf7079e989fecc1d49cf7750878f4fd5c3b3be14ec726618ea81eac867597911
- MD5 45e7f0821215b69a9cc2a519969650d6
- SHA1 ce178f7fbafcaee69ece2993a326b2bbf2826f66
- SHA512 2498a020a90db61e5e533e049351b95ef1d0733951b2e434668f215101ea1a7c63ebed59b7381a173df3347e96a78314444f11c6f57e15b64035c410578e9c17
- SSDEEP 98304:8IwM4BeFgc22QmCp2hbN++fZnEjcN6iR9+6nVisNP7h6hxvWbrtUTrUHOkZ8:0jyvQUEQsa9+6nVfP7Ex+NcIOk2
- TLSH T1FA269DF0A62DC061D932113C4BA5623F6167BF105F258F839942393A1DFFAB9472E16E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory