General
- Target 2026-07-08_33d975936b28e8b75e85669c1db2acb0_coinminer_darkgate_darpapox_elex_gcleaner_nymaim_rhadamanthys_wannacry
- Size 2.3MB
- Sample260708-nkpplsfz3l
- SHA256 fc027a6f299c860395a09cf8d7ae47c1b9a0100807ac30d13bec8548e0fcc66d
- MD5 33d975936b28e8b75e85669c1db2acb0
- SHA1 627d153226ba2ad60d35980b84c31f546205a10e
- SHA512 967a3f2d415c7988b6684dc00a5c610616a5a80a48e4293acd574e0332ec6c7e71f8b28ef45dd6bb5f4050135f9bf05fa5e383fd97e6fe46cc168e53032cc83b
- SSDEEP 49152:GKst0p9ypbTChxKCnFnQXBbrtgb/iQvu0UHOc:GKsamp6hxvWbrtUTrUHOc
- TLSH T19AB5E01273A0CC32E22B91358AC79FB978377D103B32D9472FE439385FB4E4AA695156
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_33d975936b28e8b75e85669c1db2acb0_coinminer_darkgate_darpapox_elex_gcleaner_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_33d975936b28e8b75e85669c1db2acb0_coinminer_darkgate_darpapox_elex_gcleaner_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260706-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-08_33d975936b28e8b75e85669c1db2acb0_coinminer_darkgate_darpapox_elex_gcleaner_nymaim_rhadamanthys_wannacry
- Size 2.3MB
- SHA256 fc027a6f299c860395a09cf8d7ae47c1b9a0100807ac30d13bec8548e0fcc66d
- MD5 33d975936b28e8b75e85669c1db2acb0
- SHA1 627d153226ba2ad60d35980b84c31f546205a10e
- SHA512 967a3f2d415c7988b6684dc00a5c610616a5a80a48e4293acd574e0332ec6c7e71f8b28ef45dd6bb5f4050135f9bf05fa5e383fd97e6fe46cc168e53032cc83b
- SSDEEP 49152:GKst0p9ypbTChxKCnFnQXBbrtgb/iQvu0UHOc:GKsamp6hxvWbrtUTrUHOc
- TLSH T19AB5E01273A0CC32E22B91358AC79FB978377D103B32D9472FE439385FB4E4AA695156
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory