General
- Target 2026-06-29_bf0cd9b50dfc7e34e692c5a12f94724e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260630-enppcaex6n
- SHA256 a71e9c3d3543a19fd27094c3f4af664d036ab31948d3ba4af0857ae1df424059
- MD5 bf0cd9b50dfc7e34e692c5a12f94724e
- SHA1 00799f78d718218ba38580c71cab51e11f0e1899
- SHA512 bc288ffeb5cd14288ffdd1a20b4c4ad0fae2b6c292de7b60f47f6d2c4a18283ccc76aba65209bd464b741a4207509265f7f5394f88e3777e5fb4414b46c35a86
- SSDEEP 196608:EPTvi/Mn/R15fmmBLDHgWKL6qw5LTK+ZrsrB3ttd9n5ZjBxcO4TjV2VNgb0J1m+H:Ebv4Mn/R1FlnXEOThWVhJk2NbJs+
- TLSH T1D2D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-29_bf0cd9b50dfc7e34e692c5a12f94724e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-29_bf0cd9b50dfc7e34e692c5a12f94724e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260629-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-29_bf0cd9b50dfc7e34e692c5a12f94724e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 a71e9c3d3543a19fd27094c3f4af664d036ab31948d3ba4af0857ae1df424059
- MD5 bf0cd9b50dfc7e34e692c5a12f94724e
- SHA1 00799f78d718218ba38580c71cab51e11f0e1899
- SHA512 bc288ffeb5cd14288ffdd1a20b4c4ad0fae2b6c292de7b60f47f6d2c4a18283ccc76aba65209bd464b741a4207509265f7f5394f88e3777e5fb4414b46c35a86
- SSDEEP 196608:EPTvi/Mn/R15fmmBLDHgWKL6qw5LTK+ZrsrB3ttd9n5ZjBxcO4TjV2VNgb0J1m+H:Ebv4Mn/R1FlnXEOThWVhJk2NbJs+
- TLSH T1D2D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE