General
- Target 2026-07-02_d56bc9558482a423c20a2315ccdf96d5_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260702-lqf9bady4k
- SHA256 f80a9aaede2719f51720a8b2d5f8f36daa98536c4601aa6864aafa58f89b79ee
- MD5 d56bc9558482a423c20a2315ccdf96d5
- SHA1 0a44ad2e8cc440d79948abdc5f00a36b8d9219f4
- SHA512 d6770e7bcfddb9f496f1174e8a22c8e9ca6bd778509236373b65d9f9dcbcf72c6d63ee6c50a28d6f2ceed6c9185c1a2fe113a75564e0b744f983875cd9393eaf
- SSDEEP 196608:EP6YD/Mn/R15fmmZ+2HgWKL+qw5L1K+ZtXcB3tTdgC5ZjBxcO4TnV2VNgbPJ1m+H:EiYjMn/R1FdlXEi1fsr7Jo2NwJs+
- TLSH T139D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-02_d56bc9558482a423c20a2315ccdf96d5_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_d56bc9558482a423c20a2315ccdf96d5_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260629-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_d56bc9558482a423c20a2315ccdf96d5_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 f80a9aaede2719f51720a8b2d5f8f36daa98536c4601aa6864aafa58f89b79ee
- MD5 d56bc9558482a423c20a2315ccdf96d5
- SHA1 0a44ad2e8cc440d79948abdc5f00a36b8d9219f4
- SHA512 d6770e7bcfddb9f496f1174e8a22c8e9ca6bd778509236373b65d9f9dcbcf72c6d63ee6c50a28d6f2ceed6c9185c1a2fe113a75564e0b744f983875cd9393eaf
- SSDEEP 196608:EP6YD/Mn/R15fmmZ+2HgWKL+qw5L1K+ZtXcB3tTdgC5ZjBxcO4TnV2VNgbPJ1m+H:EiYjMn/R1FdlXEi1fsr7Jo2NwJs+
- TLSH T139D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Drops file in System32 directory