General
- Target 2026-06-28_e2a95819e9d02fc9b500d97af40899f7_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260628-w28stabw3z
- SHA256 aa05c84abe5a31861ed0eb32125a84c286dab5233e2aa3a8831f9189c8cad2fd
- MD5 e2a95819e9d02fc9b500d97af40899f7
- SHA1 3c8554f6d62898347b82c2a06bdacadb9410195f
- SHA512 25be1ef1f1c828f49e7f2eaf9a15bfeaffc07ea876a3a4ddb5e49efe6fd6858f3add5b1c721ebf1b824bd764d05fae2fac04694069e1941dcf5fa3cd6b6eb218
- SSDEEP 196608:EP0vi/Mn/R15fmmpLDHgAKL6qw5LTK+vtscBKtTdgn5ZjBxcO4xjV2VNgbZJ1m+H:E8v4Mn/R1FtnFEOTtBs6JG2NGJs+
- TLSH T159D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-28_e2a95819e9d02fc9b500d97af40899f7_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_e2a95819e9d02fc9b500d97af40899f7_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260618-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-28_e2a95819e9d02fc9b500d97af40899f7_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 aa05c84abe5a31861ed0eb32125a84c286dab5233e2aa3a8831f9189c8cad2fd
- MD5 e2a95819e9d02fc9b500d97af40899f7
- SHA1 3c8554f6d62898347b82c2a06bdacadb9410195f
- SHA512 25be1ef1f1c828f49e7f2eaf9a15bfeaffc07ea876a3a4ddb5e49efe6fd6858f3add5b1c721ebf1b824bd764d05fae2fac04694069e1941dcf5fa3cd6b6eb218
- SSDEEP 196608:EP0vi/Mn/R15fmmpLDHgAKL6qw5LTK+vtscBKtTdgn5ZjBxcO4xjV2VNgbZJ1m+H:E8v4Mn/R1FtnFEOTtBs6JG2NGJs+
- TLSH T159D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE