General
- Target 2026-06-28_6cca6bbaa7eae2df164e4d26da976e32_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 15.7MB
- Sample260628-1rtclafx5j
- SHA256 2e3bb94d174b6126d53c00c651e863bb00e63e5b0aa5c15b1aebeab830fc59db
- MD5 6cca6bbaa7eae2df164e4d26da976e32
- SHA1 c129a63e974b4b3a0e6b25b4b10b07effe2e061b
- SHA512 9235e9b39a4777144a881bbdcd819a4d9c1913891c67b2dfb175f4235626bdf3effa7952fd448932897e03e13312b298d621e82fe14d09694d69fb1adb48660c
- SSDEEP 393216:Abn7d78v4Mn/R1FtnFEOnrBs6Jk2NOJs+:ep7ZM/LbnFFS6Jk2oZ
- TLSH T19EF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-28_6cca6bbaa7eae2df164e4d26da976e32_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_6cca6bbaa7eae2df164e4d26da976e32_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260618-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-28_6cca6bbaa7eae2df164e4d26da976e32_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 15.7MB
- SHA256 2e3bb94d174b6126d53c00c651e863bb00e63e5b0aa5c15b1aebeab830fc59db
- MD5 6cca6bbaa7eae2df164e4d26da976e32
- SHA1 c129a63e974b4b3a0e6b25b4b10b07effe2e061b
- SHA512 9235e9b39a4777144a881bbdcd819a4d9c1913891c67b2dfb175f4235626bdf3effa7952fd448932897e03e13312b298d621e82fe14d09694d69fb1adb48660c
- SSDEEP 393216:Abn7d78v4Mn/R1FtnFEOnrBs6Jk2NOJs+:ep7ZM/LbnFFS6Jk2oZ
- TLSH T19EF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE