2026-08-19_9d813e5a5e6a57bb0b3690223cc9b131_coinminer_darkgate_darpapox_elex_gcleaner_hijackloader_nymaim_rhadamanthys_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_9d813e5a5e6a57bb0b3690223cc9b131_coinminer_darkgate_darpapox_elex_gcleaner_hijackloader_nymaim_rhadamanthys_wannacry
Size 4.2MB
Sample260819-sa124swgrc
SHA256 e337b687aafbaa5a24b26aa7c7ef1d4c31b58aff5262368b0bd8d092b9340d94
MD5 9d813e5a5e6a57bb0b3690223cc9b131
SHA1 654f87153a9cd047c26c34b6101115f40aa37ef2
SHA512 d593a5847c8da74c213ceda8a29c64f66c9f3c67e556e90e012e102c425c5e601856e5eb2900f902112bb961d7999c79e121667a9e7f3bc397a7e98a72f0a2a9
SSDEEP 98304:yo1I9mS8AluA3jc9Re6OgSQ56hxvWbrtUTrUHOZ:qElQusYPeE58x+NcIOZ
TLSH
T19616D0A19E89F86CFE1AA43586C0B974EB2F14362FA2C4D13F5C913D0BFF5269661113
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

installer

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-19_9d813e5a5e6a57bb0b3690223cc9b131_coinminer_darkgate_darpapox_elex_gcleaner_hijackloader_nymaim_rhadamanthys_wannacry

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
sample	innosetup

File Explorer

2026-08-19_9d813e5a5e6a57bb0b3690223cc9b131_coinminer_darkgate_darpapox_elex_gcleaner_hijackloader_nymaim_rhadamanthys_wannacry

.exe 4.2MB

2026-08-19_9d813e5a5e6a57bb0b3690223cc9b131_coinminer_darkgate_darpapox_elex_gcleaner_hijackloader_nymaim_rhadamanthys_wannacry

IMPHASH 730073214094cd328547bf1f72289752
SHA256 e337b687aafbaa5a24b26aa7c7ef1d4c31b58aff5262368b0bd8d092b9340d94
MD5 9d813e5a5e6a57bb0b3690223cc9b131
SHA1 654f87153a9cd047c26c34b6101115f40aa37ef2
SHA512 d593a5847c8da74c213ceda8a29c64f66c9f3c67e556e90e012e102c425c5e601856e5eb2900f902112bb961d7999c79e121667a9e7f3bc397a7e98a72f0a2a9
SSDEEP 98304:yo1I9mS8AluA3jc9Re6OgSQ56hxvWbrtUTrUHOZ:qElQusYPeE58x+NcIOZ
TLSH
T19616D0A19E89F86CFE1AA43586C0B974EB2F14362FA2C4D13F5C913D0BFF5269661113
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.
Inno Setup is an open-source installation builder for Windows applications.

Inno Setup installer

installer

PE Signature issue

Digest

b7:b9:76:7f:df:c1:32:4e:5d:7e:e4:45:2f:5e:5a:cd:12:51:c5:e1:5a:b3:ca:8b:fe:31:af:b3:01:84:75:ca

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Chains

Sep 18, 2024

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

f1:7e:9d:66:7d:8d:e1:4c:b7:b0:df:42:8e:eb:cb:3f:34:ae:54:41

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Chains

Sep 18, 2024

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Serial Number

07:86:04:2c:e3:96:2b:e7:6a:63:df:f9:e1:40:77:6d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 2, 2023 - Oct 1, 2024

Minor OS version

Major OS version

Entry point

5759

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

2026-08-19_9d813e5a5e6a57bb0b3690223cc9b131_coinminer_darkgate_darpapox_elex_gcleaner_hijackloader_nymaim_rhadamanthys_wannacry

PE Signature issue

PE Signature issue

kernel32

user32

shell32

msvcrt

generic