General
- Target 2026-06-27_f280f1bfa57748ef7184f86b586c5dc7_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260629-bs3j8abv2j
- SHA256 fb9bfa8f4ff1676e7e62b996d23a49ba21bd98581d038494f41bc2c417b85b2f
- MD5 f280f1bfa57748ef7184f86b586c5dc7
- SHA1 3796572c7ca958b6df3c171913a8b82df5775a87
- SHA512 25d64c1bb83e5c6bc9b8b3cf4d1c64b599c632c9b6612ab799cedf34687f6a109dcdc0e945e81854611f474be5e75a7e53c9683d034965ef016a16290e13c14f
- SSDEEP 196608:EP/vi/Mn/R1RfmmBL4Hg0KLnqw5LQx+ZDscBlvtdUTJZjBxcO4TzV2VNKbPJ1mjH:Env4Mn/R1tlutE9QqBZSJ02NuJsj
- TLSH T152D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-27_f280f1bfa57748ef7184f86b586c5dc7_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_f280f1bfa57748ef7184f86b586c5dc7_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260618-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-27_f280f1bfa57748ef7184f86b586c5dc7_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 fb9bfa8f4ff1676e7e62b996d23a49ba21bd98581d038494f41bc2c417b85b2f
- MD5 f280f1bfa57748ef7184f86b586c5dc7
- SHA1 3796572c7ca958b6df3c171913a8b82df5775a87
- SHA512 25d64c1bb83e5c6bc9b8b3cf4d1c64b599c632c9b6612ab799cedf34687f6a109dcdc0e945e81854611f474be5e75a7e53c9683d034965ef016a16290e13c14f
- SSDEEP 196608:EP/vi/Mn/R1RfmmBL4Hg0KLnqw5LQx+ZDscBlvtdUTJZjBxcO4TzV2VNKbPJ1mjH:Env4Mn/R1tlutE9QqBZSJ02NuJsj
- TLSH T152D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE