General
- Target 2026-07-17_bb7c7ca9b92337edfcfde3d7b9db77bc_amadey_coinminer_darkgate_darpapox_elex_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader_wannacry
- Size 5.6MB
- Sample260717-fpsytsbt2n
- SHA256 510e9b1740831e15ce5828f014ce47a520d17eeb4c5a59480e219b44d844d48d
- MD5 bb7c7ca9b92337edfcfde3d7b9db77bc
- SHA1 9ec52b1d2cd3943f9ed177d86c77efd28370815e
- SHA512 20921f0486b87ba8e008d794b7d1f00e36517a26baa8551f94c685b799840d31359f122015d8ccc0000d5f4b846e93b7af840d2c0da1e42eb29563115a12f18c
- SSDEEP 98304:T1OINSoOulm6Dlh/IhE0Hs7tXUYMtLgFnvMxwXRMnbA0+3zR6FgI4ARHIL15Gpyh:fF0+d6lOK5aVU4ojDIg9Cbk/V0/kx+Nz
- TLSH T17946E0227EB84B6BD46702318ED9F638717FBD743736819722483B397A703924B1A527
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_bb7c7ca9b92337edfcfde3d7b9db77bc_amadey_coinminer_darkgate_darpapox_elex_icedid_luca-stea.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_bb7c7ca9b92337edfcfde3d7b9db77bc_amadey_coinminer_darkgate_darpapox_elex_icedid_luca-stea.exe
Resource
win11ltsc2024-20260709-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-17_bb7c7ca9b92337edfcfde3d7b9db77bc_amadey_coinminer_darkgate_darpapox_elex_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader_wannacry
- Size 5.6MB
- SHA256 510e9b1740831e15ce5828f014ce47a520d17eeb4c5a59480e219b44d844d48d
- MD5 bb7c7ca9b92337edfcfde3d7b9db77bc
- SHA1 9ec52b1d2cd3943f9ed177d86c77efd28370815e
- SHA512 20921f0486b87ba8e008d794b7d1f00e36517a26baa8551f94c685b799840d31359f122015d8ccc0000d5f4b846e93b7af840d2c0da1e42eb29563115a12f18c
- SSDEEP 98304:T1OINSoOulm6Dlh/IhE0Hs7tXUYMtLgFnvMxwXRMnbA0+3zR6FgI4ARHIL15Gpyh:fF0+d6lOK5aVU4ojDIg9Cbk/V0/kx+Nz
- TLSH T17946E0227EB84B6BD46702318ED9F638717FBD743736819722483B397A703924B1A527
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory