General
- Target 2026-07-12_86aa4ae201fd1b04c3e504eed4d258ac_coinminer_darkgate_darpapox_elex_nymaim_rhadamanthys_smoke-loader_wannacry
- Size 3.7MB
- Sample260712-t68mhadv4j
- SHA256 8d98222271108f187e35889073e8ee00b25cabeafa4f7da7fea6299e35cdfb7c
- MD5 86aa4ae201fd1b04c3e504eed4d258ac
- SHA1 bc3e0a4f1681ad33e38ab5f2e2ea818d6b6f806e
- SHA512 07ac97101f586feb1bf8ca3bb0d00414f51615db7a3fd4cd94aa0173367a65c8fa6c8f5b7797e49bffeb7647177bb5e4931dadb5768a2ac2cd2d1c26c1b1f11b
- SSDEEP 98304:4ApWIGOTW9Y3OqkWXNc3lfFmtH8rIyBcgD5jvN6hxvWbrtUTrUHO5:L6UXN2Fc8rIy3jvwx+NcIO5
- TLSH T1A906E1213790C47AD237623156CAA7B4B2B7AD305F72858B17843E396F70493DA6836F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_86aa4ae201fd1b04c3e504eed4d258ac_coinminer_darkgate_darpapox_elex_nymaim_rhadamanthys_smoke-loader_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_86aa4ae201fd1b04c3e504eed4d258ac_coinminer_darkgate_darpapox_elex_nymaim_rhadamanthys_smoke-loader_wannacry.exe
Resource
win11ltsc2024-20260710-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-12_86aa4ae201fd1b04c3e504eed4d258ac_coinminer_darkgate_darpapox_elex_nymaim_rhadamanthys_smoke-loader_wannacry
- Size 3.7MB
- SHA256 8d98222271108f187e35889073e8ee00b25cabeafa4f7da7fea6299e35cdfb7c
- MD5 86aa4ae201fd1b04c3e504eed4d258ac
- SHA1 bc3e0a4f1681ad33e38ab5f2e2ea818d6b6f806e
- SHA512 07ac97101f586feb1bf8ca3bb0d00414f51615db7a3fd4cd94aa0173367a65c8fa6c8f5b7797e49bffeb7647177bb5e4931dadb5768a2ac2cd2d1c26c1b1f11b
- SSDEEP 98304:4ApWIGOTW9Y3OqkWXNc3lfFmtH8rIyBcgD5jvN6hxvWbrtUTrUHO5:L6UXN2Fc8rIy3jvwx+NcIO5
- TLSH T1A906E1213790C47AD237623156CAA7B4B2B7AD305F72858B17843E396F70493DA6836F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory