General
- Target 2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader_wannacry
- Size 2.6MB
- Sample261110-zn449aba95
- SHA256 fdc6aef1520e74e9576c7911ebbd26bad3252d1443661dd567490e9ec0b0de7d
- MD5 4766560ec0c625cbbd5b581dfc1861d9
- SHA1 3d3654a6fb939d7cf91eb5da33ce902b540c757f
- SHA512 12b71f632baf35f8fda56988ebbc4c55dd01662fa869481dc436a2fb6f9c5205da0e5bc6475383b1d93f275ea6927d85631e40425ec401136d93868746221d81
- SSDEEP 49152:ybLVD2jn3CQLrXA8BkfiBxbTChxKCnFnQXBbrtgb/iQvu0UHOL:yp2j3LdkSx6hxvWbrtUTrUHOL
- TLSH T149C5F111B301E472E5A780B14BE4BF7B743F64241B369DDBB7C84A392EB05C29B70696
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njr.exe
Resource
win10v2004-20260911-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njr.exe
Resource
win11ltsc2024-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader_wannacry
- Size 2.6MB
- SHA256 fdc6aef1520e74e9576c7911ebbd26bad3252d1443661dd567490e9ec0b0de7d
- MD5 4766560ec0c625cbbd5b581dfc1861d9
- SHA1 3d3654a6fb939d7cf91eb5da33ce902b540c757f
- SHA512 12b71f632baf35f8fda56988ebbc4c55dd01662fa869481dc436a2fb6f9c5205da0e5bc6475383b1d93f275ea6927d85631e40425ec401136d93868746221d81
- SSDEEP 49152:ybLVD2jn3CQLrXA8BkfiBxbTChxKCnFnQXBbrtgb/iQvu0UHOL:yp2j3LdkSx6hxvWbrtUTrUHOL
- TLSH T149C5F111B301E472E5A780B14BE4BF7B743F64241B369DDBB7C84A392EB05C29B70696
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1