General
- Target 2026-07-01_5eb26885cbcab54c0ce9c787033eda56_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbot_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_loki-bot_luca-stealer_njrat_ramnit_remcos_smoke-loader_stealc_vidar_wannacry
- Size 36.5MB
- Sample260701-lplgmsay2r
- SHA256 e080f09a2e059f6341fa888e6e4a8dd3366c478ad99386a9ee4cc97e6fdfc86e
- MD5 5eb26885cbcab54c0ce9c787033eda56
- SHA1 df803794ff798a1b28025d4c1b8feae63fabc46d
- SHA512 a583a029881512e3178df1ad1b10be6379881cbb44a47ba75c25704d3393a269b25663a350f01767ff2dc172d1bb208e46e1eacc9056a56a5c369a8d3b3af6b1
- SSDEEP 786432:dHE6LJFM/qkR+grttUxgvOj7ZM/LbOXmC6JT2K:dHE6LJe/L0cttGVj7uLbEmFB2K
- TLSH T12987E0A699B002E1F97A8434CE52A526D9317C190B608BCF369CB65F2F737F2583E345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-01_5eb26885cbcab54c0ce9c787033eda56_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbo.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_5eb26885cbcab54c0ce9c787033eda56_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbo.exe
Resource
win11ltsc2024-20260629-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-01_5eb26885cbcab54c0ce9c787033eda56_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbot_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_loki-bot_luca-stealer_njrat_ramnit_remcos_smoke-loader_stealc_vidar_wannacry
- Size 36.5MB
- SHA256 e080f09a2e059f6341fa888e6e4a8dd3366c478ad99386a9ee4cc97e6fdfc86e
- MD5 5eb26885cbcab54c0ce9c787033eda56
- SHA1 df803794ff798a1b28025d4c1b8feae63fabc46d
- SHA512 a583a029881512e3178df1ad1b10be6379881cbb44a47ba75c25704d3393a269b25663a350f01767ff2dc172d1bb208e46e1eacc9056a56a5c369a8d3b3af6b1
- SSDEEP 786432:dHE6LJFM/qkR+grttUxgvOj7ZM/LbOXmC6JT2K:dHE6LJe/L0cttGVj7uLbEmFB2K
- TLSH T12987E0A699B002E1F97A8434CE52A526D9317C190B608BCF369CB65F2F737F2583E345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing possible sandbox analysis VM usernames
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE