General
- Target 2026-10-25_c131980bf31d7b75e478b455dc6857e1_amadey_coinminer_darkgate_elex_nymaim_rhadamanthys_wannacry
- Size 4.6MB
- Sample261026-qsyzcsbb83
- SHA256 4a3383594bcb06e5ff5ea4e9454ec24a924a6c004a93a0e4959f1a6244f00bda
- MD5 c131980bf31d7b75e478b455dc6857e1
- SHA1 684df86eb8a282d0254bf5a962e106fb64fa2514
- SHA512 32f8f8943455fc562911c1b79140eabc2e7c51d73b963a99ccde090f27c86cf13c188e5519cc69933d7717c25e1979642e6191eedfb7f9e50b456cbac4d6f405
- SSDEEP 98304:RrqcSFJspDLOMgd4x6hxvWbrtUTrUHO9RSFJspDLOMgdB:MpIDLwy0x+NcIO9+IDLwH
- TLSH T1B926CF01E7E6C520FAFBAB7D5AF85A712A377C606B35C94E1B4401780AF0E55DBA0723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-25_c131980bf31d7b75e478b455dc6857e1_amadey_coinminer_darkgate_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-25_c131980bf31d7b75e478b455dc6857e1_amadey_coinminer_darkgate_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260911-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-25_c131980bf31d7b75e478b455dc6857e1_amadey_coinminer_darkgate_elex_nymaim_rhadamanthys_wannacry
- Size 4.6MB
- SHA256 4a3383594bcb06e5ff5ea4e9454ec24a924a6c004a93a0e4959f1a6244f00bda
- MD5 c131980bf31d7b75e478b455dc6857e1
- SHA1 684df86eb8a282d0254bf5a962e106fb64fa2514
- SHA512 32f8f8943455fc562911c1b79140eabc2e7c51d73b963a99ccde090f27c86cf13c188e5519cc69933d7717c25e1979642e6191eedfb7f9e50b456cbac4d6f405
- SSDEEP 98304:RrqcSFJspDLOMgd4x6hxvWbrtUTrUHO9RSFJspDLOMgdB:MpIDLwy0x+NcIO9+IDLwH
- TLSH T1B926CF01E7E6C520FAFBAB7D5AF85A712A377C606B35C94E1B4401780AF0E55DBA0723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application