General
- Target 2026-07-02_ff307a7e4c60355d8244b060afb7714b_agent-tesla_akira_cobalt-strike_coinminer_cryptbot_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_loki-bot_luca-stealer_njrat_ramnit_remcos_stealc_vidar_wannacry
- Size 33.4MB
- Sample260702-rnqb4afx71
- SHA256 77d26187ec82b9b10cdeab625853691ff9903a9bda1706da645affc49dec400f
- MD5 ff307a7e4c60355d8244b060afb7714b
- SHA1 a6f9760e00da322675da2f7dac259fd811191663
- SHA512 8ebeae2b3cac30681fdf1eab029a391966c06fbe49f8529b4653c173ef5456611d51c5076004efd38f5e1abd3747b405c6ea7db3c753d233a553583cb1130c85
- SSDEEP 786432:STE6LJlM/qkR+qO9tUxgvOppOM/LbvXFE:STE6LJ+/L0H9tGVppnLbfFE
- TLSH T1B977E0A6997002E1FA7A8834CE52A526D9317C194B708BCF3A9CB55F1B737F2583E344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-02_ff307a7e4c60355d8244b060afb7714b_agent-tesla_akira_cobalt-strike_coinminer_cryptbot_darkg.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_ff307a7e4c60355d8244b060afb7714b_agent-tesla_akira_cobalt-strike_coinminer_cryptbot_darkg.exe
Resource
win11ltsc2024-20260629-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_ff307a7e4c60355d8244b060afb7714b_agent-tesla_akira_cobalt-strike_coinminer_cryptbot_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_loki-bot_luca-stealer_njrat_ramnit_remcos_stealc_vidar_wannacry
- Size 33.4MB
- SHA256 77d26187ec82b9b10cdeab625853691ff9903a9bda1706da645affc49dec400f
- MD5 ff307a7e4c60355d8244b060afb7714b
- SHA1 a6f9760e00da322675da2f7dac259fd811191663
- SHA512 8ebeae2b3cac30681fdf1eab029a391966c06fbe49f8529b4653c173ef5456611d51c5076004efd38f5e1abd3747b405c6ea7db3c753d233a553583cb1130c85
- SSDEEP 786432:STE6LJlM/qkR+qO9tUxgvOppOM/LbvXFE:STE6LJ+/L0H9tGVppnLbfFE
- TLSH T1B977E0A6997002E1FA7A8834CE52A526D9317C194B708BCF3A9CB55F1B737F2583E344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing possible sandbox analysis VM usernames
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE