General
- Target 2026-08-19_acdd6d3c2bb16acdccfc32e07d36bb46_coinminer_darkgate_darpapox_elex_jaku_nymaim_rhadamanthys_smoke-loader_stop_wannacry
- Size 1.9MB
- Sample260819-r63edaywcy
- SHA256 32c5aff956f5e0e96b64d4c7fdd7695a32d2f10cd890af683d7548579af90eaa
- MD5 acdd6d3c2bb16acdccfc32e07d36bb46
- SHA1 27c86c3a4cae73a68f38844f3ec965ac5732f5c8
- SHA512 c91db0aa21e5da96ac22150ab00854902a9b36a6548047fe7cf2d34636ba155c504f29985147fa96c6326a10fc5097009960f94ec715312002a53611a00d4dcd
- SSDEEP 49152:xfsR1bTChxKCnFnQXBbrtgb/iQvu0UHOq:xfc16hxvWbrtUTrUHOq
- TLSH T15F95EF002790CD22F35FC07647E59E7A7577A9213B33DD866A8806392BF1E9FD7A1242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_acdd6d3c2bb16acdccfc32e07d36bb46_coinminer_darkgate_darpapox_elex_jaku_nymaim_rhadamanthy.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_acdd6d3c2bb16acdccfc32e07d36bb46_coinminer_darkgate_darpapox_elex_jaku_nymaim_rhadamanthy.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_acdd6d3c2bb16acdccfc32e07d36bb46_coinminer_darkgate_darpapox_elex_jaku_nymaim_rhadamanthys_smoke-loader_stop_wannacry
- Size 1.9MB
- SHA256 32c5aff956f5e0e96b64d4c7fdd7695a32d2f10cd890af683d7548579af90eaa
- MD5 acdd6d3c2bb16acdccfc32e07d36bb46
- SHA1 27c86c3a4cae73a68f38844f3ec965ac5732f5c8
- SHA512 c91db0aa21e5da96ac22150ab00854902a9b36a6548047fe7cf2d34636ba155c504f29985147fa96c6326a10fc5097009960f94ec715312002a53611a00d4dcd
- SSDEEP 49152:xfsR1bTChxKCnFnQXBbrtgb/iQvu0UHOq:xfc16hxvWbrtUTrUHOq
- TLSH T15F95EF002790CD22F35FC07647E59E7A7577A9213B33DD866A8806392BF1E9FD7A1242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory