General
- Target 2026-07-01_67521bd352397326b5ade8a91d1660e1_coinminer_darkgate_darpapox_elex_nymaim_rhadamanthys_wannacry
- Size 3.7MB
- Sample260701-n3f57ac18n
- SHA256 2a2385da33d9042bd667d1264e63e716156ac8e1145fcf19ed168bc691bcf5fd
- MD5 67521bd352397326b5ade8a91d1660e1
- SHA1 7fcf6f7d0b88663be6afec3a0e2f9fb679ee1e8b
- SHA512 91858caaeed7fc6eadcc6f2aa1e5c21605a85f336db5f272b289931cc6a7daf174015a1848392b104ab34024e813d0b05d0d54a65eeb40dec9ab65edbfcd53c8
- SSDEEP 98304:5r4aqLft0AJL6KDGeqOrLOTreMuoTlaE9mW/t6hxvWbrtUTrUHOA:dlqLLEyOt1ZaE9m4Qx+NcIOA
- TLSH T15906D0227752C072C66735314ACDA7BDB27AA5301B3996F39B900E392E705D3DA3825F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_67521bd352397326b5ade8a91d1660e1_coinminer_darkgate_darpapox_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_67521bd352397326b5ade8a91d1660e1_coinminer_darkgate_darpapox_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260629-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-01_67521bd352397326b5ade8a91d1660e1_coinminer_darkgate_darpapox_elex_nymaim_rhadamanthys_wannacry
- Size 3.7MB
- SHA256 2a2385da33d9042bd667d1264e63e716156ac8e1145fcf19ed168bc691bcf5fd
- MD5 67521bd352397326b5ade8a91d1660e1
- SHA1 7fcf6f7d0b88663be6afec3a0e2f9fb679ee1e8b
- SHA512 91858caaeed7fc6eadcc6f2aa1e5c21605a85f336db5f272b289931cc6a7daf174015a1848392b104ab34024e813d0b05d0d54a65eeb40dec9ab65edbfcd53c8
- SSDEEP 98304:5r4aqLft0AJL6KDGeqOrLOTreMuoTlaE9mW/t6hxvWbrtUTrUHOA:dlqLLEyOt1ZaE9m4Qx+NcIOA
- TLSH T15906D0227752C072C66735314ACDA7BDB27AA5301B3996F39B900E392E705D3DA3825F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory