General
- Target 2026-07-17_1a0a35d45a612751f1ea154651bb8ce6_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry
- Size 10.4MB
- Sample260717-fwf8lsbv7p
- SHA256 bc6e55264e4277486f5f954c24d258eabc3694842919e98af28771bd83df2ff4
- MD5 1a0a35d45a612751f1ea154651bb8ce6
- SHA1 77c3eca8f97547579054af91b10a43ff79623bfb
- SHA512 9f3f6ff907e1c39925968c74c7414fe2a2b740f743728f9516ddafd70a3d1cd0331c10997ae396149b3a98a7c1844076e5889c99f5038f35baf1fd159b65a5c1
- SSDEEP 196608:5xvtkUqcbGtAo/obahtXNV7eZwn9P/5rmN6sBLAx+NcIOA:51HqcbcL/obapteE9P/5rmNtLAkNcIF
- TLSH T1C2B6394CBA98E562C56325F42B4AA6A95425BE347E38C40F7B7C3F4EE3F17E1B51010A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_1a0a35d45a612751f1ea154651bb8ce6_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_1a0a35d45a612751f1ea154651bb8ce6_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-17_1a0a35d45a612751f1ea154651bb8ce6_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry
- Size 10.4MB
- SHA256 bc6e55264e4277486f5f954c24d258eabc3694842919e98af28771bd83df2ff4
- MD5 1a0a35d45a612751f1ea154651bb8ce6
- SHA1 77c3eca8f97547579054af91b10a43ff79623bfb
- SHA512 9f3f6ff907e1c39925968c74c7414fe2a2b740f743728f9516ddafd70a3d1cd0331c10997ae396149b3a98a7c1844076e5889c99f5038f35baf1fd159b65a5c1
- SSDEEP 196608:5xvtkUqcbGtAo/obahtXNV7eZwn9P/5rmN6sBLAx+NcIOA:51HqcbcL/obapteE9P/5rmNtLAkNcIF
- TLSH T1C2B6394CBA98E562C56325F42B4AA6A95425BE347E38C40F7B7C3F4EE3F17E1B51010A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory