General
- Target 2026-07-03_ba5eebe68f15191344294422ba86d722_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 15.7MB
- Sample260703-c4cnlsat5t
- SHA256 91f9066130551ec81fb095a0ac7d590bb4b702a0fd3ad5c02563b994afb674fe
- MD5 ba5eebe68f15191344294422ba86d722
- SHA1 47a1782f49709ca0e91f040bdecb67a39e964e12
- SHA512 93497c38238f7bb33fa32d043f87579ffdd45a965e7f65a6c81e8e444905f7761711f3978089de0eace262bbff84ee0a9fcd43774b6929db970a30f1ccd2fa7d
- SSDEEP 393216:pbn7d78v4Mn/R1FtGXEjThBr6Jk4NwJsj:9p7ZM/LbGXgv6Jk42w
- TLSH T12EF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-03_ba5eebe68f15191344294422ba86d722_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_ba5eebe68f15191344294422ba86d722_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260629-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-03_ba5eebe68f15191344294422ba86d722_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 15.7MB
- SHA256 91f9066130551ec81fb095a0ac7d590bb4b702a0fd3ad5c02563b994afb674fe
- MD5 ba5eebe68f15191344294422ba86d722
- SHA1 47a1782f49709ca0e91f040bdecb67a39e964e12
- SHA512 93497c38238f7bb33fa32d043f87579ffdd45a965e7f65a6c81e8e444905f7761711f3978089de0eace262bbff84ee0a9fcd43774b6929db970a30f1ccd2fa7d
- SSDEEP 393216:pbn7d78v4Mn/R1FtGXEjThBr6Jk4NwJsj:9p7ZM/LbGXgv6Jk42w
- TLSH T12EF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE