General
- Target 2026-06-26_e7605220a3b3de24da0c17207f60c9b6_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260629-nkhajady2l
- SHA256 aa9c33888c65226d98617616e9e325d21332ff72919b65d9d0ec3a70c789adc0
- MD5 e7605220a3b3de24da0c17207f60c9b6
- SHA1 7c50e9f8b13eb46e503746bf13743c99d25f6fb3
- SHA512 a7aa320839fd0aa4388eeaade6c40d978dcd067d80c2f4427e398ca6333c4d99055e82393104232c51a6cc9ca07c6ffc5e25f8f943ad31bb535b9ca436014157
- SSDEEP 196608:Eg1vi/Mn/S1hfmmNLDHkWKLCqw3LTK+ZDscBetBdmn5ZjBxcO44zV2VOlpPJ1m5H:EYv4Mn/S19JnzEoT5B+cJV2O7Js5
- TLSH T1A0D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-26_e7605220a3b3de24da0c17207f60c9b6_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_e7605220a3b3de24da0c17207f60c9b6_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260618-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-26_e7605220a3b3de24da0c17207f60c9b6_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 aa9c33888c65226d98617616e9e325d21332ff72919b65d9d0ec3a70c789adc0
- MD5 e7605220a3b3de24da0c17207f60c9b6
- SHA1 7c50e9f8b13eb46e503746bf13743c99d25f6fb3
- SHA512 a7aa320839fd0aa4388eeaade6c40d978dcd067d80c2f4427e398ca6333c4d99055e82393104232c51a6cc9ca07c6ffc5e25f8f943ad31bb535b9ca436014157
- SSDEEP 196608:Eg1vi/Mn/S1hfmmNLDHkWKLCqw3LTK+ZDscBetBdmn5ZjBxcO44zV2VOlpPJ1m5H:EYv4Mn/S19JnzEoT5B+cJV2O7Js5
- TLSH T1A0D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE