General
- Target 2026-08-21_cf82c4ee1b73bc8f3b7dfc7398469339_coinminer_darkgate_darpapox_elex_gcleaner_nymaim_rhadamanthys_wannacry
- Size 2.4MB
- Sample260821-l3bvcsssax
- SHA256 4dd509dca4240ed86989862260220c3357117c8dbd3f0e1177c648d0c7518e06
- MD5 cf82c4ee1b73bc8f3b7dfc7398469339
- SHA1 cf2f8cf164108d6c0ac22c2a0d2b297563dde31c
- SHA512 82329141544a5245167960927f62a5b3c2ff9790fa5ce3481c786773f8436471f2ff739f34464312da618a675640199b5e565e62445a24fc86d221ce3e2ff4fc
- SSDEEP 49152:Y8FjVF6tbTChxKCnFnQXBbrtgb/iQvu0UHOS:st6hxvWbrtUTrUHOS
- TLSH T17AC5E1117391C832E22B85354ADA5A717C3B7A213BB2C8061FB4C93D1FF5E46EBB5252
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-21_cf82c4ee1b73bc8f3b7dfc7398469339_coinminer_darkgate_darpapox_elex_gcleaner_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_cf82c4ee1b73bc8f3b7dfc7398469339_coinminer_darkgate_darpapox_elex_gcleaner_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-21_cf82c4ee1b73bc8f3b7dfc7398469339_coinminer_darkgate_darpapox_elex_gcleaner_nymaim_rhadamanthys_wannacry
- Size 2.4MB
- SHA256 4dd509dca4240ed86989862260220c3357117c8dbd3f0e1177c648d0c7518e06
- MD5 cf82c4ee1b73bc8f3b7dfc7398469339
- SHA1 cf2f8cf164108d6c0ac22c2a0d2b297563dde31c
- SHA512 82329141544a5245167960927f62a5b3c2ff9790fa5ce3481c786773f8436471f2ff739f34464312da618a675640199b5e565e62445a24fc86d221ce3e2ff4fc
- SSDEEP 49152:Y8FjVF6tbTChxKCnFnQXBbrtgb/iQvu0UHOS:st6hxvWbrtUTrUHOS
- TLSH T17AC5E1117391C832E22B85354ADA5A717C3B7A213BB2C8061FB4C93D1FF5E46EBB5252
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory