General
- Target 2026-07-31_c9190594bd8dfff5ee97c379473808d9_amadey_darkgate_elex_icedid_smoke-loader_wannacry
- Size 2.1MB
- Sample260731-c2afgabd54
- SHA256 a3ea44854f299396a0214d17846ea5d4cbe24d988dfddaab25124dfdd9557021
- MD5 c9190594bd8dfff5ee97c379473808d9
- SHA1 2af755e3a065959c32a8d6b1b5dab02676c327e2
- SHA512 216a076f2cf33073bc69c6e1b68b07000a26220b74ce5bdfb4264ba2ca45ffd199e94fd6917988b4fd6315375439ca4b9e93ed8c6b6b9cceb5d343788d1e1959
- SSDEEP 49152:Lrb08BpI11bxVgYpROzRvsv9YRX/Sa0pzymb3z4wYsuVSf5UMb/0IXrOLpDBtk:Lrtu11bIYpROzOv9YRX/Sa0pzymnsS5d
- TLSH T122A58C307AF1C4B6D2223631968E93B9B2699A304B7C168757A15F3D2D701C38E3D67B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_c9190594bd8dfff5ee97c379473808d9_amadey_darkgate_elex_icedid_smoke-loader_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_c9190594bd8dfff5ee97c379473808d9_amadey_darkgate_elex_icedid_smoke-loader_wannacry.exe
Resource
win11ltsc2024-20260710-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-31_c9190594bd8dfff5ee97c379473808d9_amadey_darkgate_elex_icedid_smoke-loader_wannacry
- Size 2.1MB
- SHA256 a3ea44854f299396a0214d17846ea5d4cbe24d988dfddaab25124dfdd9557021
- MD5 c9190594bd8dfff5ee97c379473808d9
- SHA1 2af755e3a065959c32a8d6b1b5dab02676c327e2
- SHA512 216a076f2cf33073bc69c6e1b68b07000a26220b74ce5bdfb4264ba2ca45ffd199e94fd6917988b4fd6315375439ca4b9e93ed8c6b6b9cceb5d343788d1e1959
- SSDEEP 49152:Lrb08BpI11bxVgYpROzRvsv9YRX/Sa0pzymb3z4wYsuVSf5UMb/0IXrOLpDBtk:Lrtu11bIYpROzOv9YRX/Sa0pzymnsS5d
- TLSH T122A58C307AF1C4B6D2223631968E93B9B2699A304B7C168757A15F3D2D701C38E3D67B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Drops file in System32 directory