General
- Target 2026-07-02_a5e5f4aebb839c21bdc61009c8d49d29_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260702-ltb4rsdz3l
- SHA256 6b425e9f57abddf7b6c995470c2ab78c9629f82ff53268324e2ce33550620eb3
- MD5 a5e5f4aebb839c21bdc61009c8d49d29
- SHA1 a31920247927b92befa288fdd560d5f01546a54d
- SHA512 7306f846ff512aa45c32b884c84fbb9ba2fc1452677399b93047eee7848c967a33740cb1d42d0751c04a08bfcbbe911348a32feb3a829b47d7d5af3e168c9c3b
- SSDEEP 196608:Ec0vi/Mn/D15mmXpLTHgWKL6qw3LTK+OgGCB3tTdgn5ZjBxcO40pJ2VNgpPJ1m+H:EVv4Mn/D10I/XEkTplr6Jr2NeJs+
- TLSH T177D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-02_a5e5f4aebb839c21bdc61009c8d49d29_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_a5e5f4aebb839c21bdc61009c8d49d29_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260629-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_a5e5f4aebb839c21bdc61009c8d49d29_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 6b425e9f57abddf7b6c995470c2ab78c9629f82ff53268324e2ce33550620eb3
- MD5 a5e5f4aebb839c21bdc61009c8d49d29
- SHA1 a31920247927b92befa288fdd560d5f01546a54d
- SHA512 7306f846ff512aa45c32b884c84fbb9ba2fc1452677399b93047eee7848c967a33740cb1d42d0751c04a08bfcbbe911348a32feb3a829b47d7d5af3e168c9c3b
- SSDEEP 196608:Ec0vi/Mn/D15mmXpLTHgWKL6qw3LTK+OgGCB3tTdgn5ZjBxcO40pJ2VNgpPJ1m+H:EVv4Mn/D10I/XEkTplr6Jr2NeJs+
- TLSH T177D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE