General
- Target 2026-07-03_4df29eff27367e74db5c038404250fb5_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_stealc_vidar
- Size 16.2MB
- Sample260703-pvmtfaes7l
- SHA256 15666a87c06f779ebc8c4bb1f603d3a3724605b4c6e8ec7b834dfb0f7ea471f0
- MD5 4df29eff27367e74db5c038404250fb5
- SHA1 50422e8ea517ca1b70b2ec21319956e087948093
- SHA512 36460c21f33f2a156db428847a3cbfac03dfd67a5f899c158efacd9d0dccd88bbc82bd0f2446da2e2a09f96cbc476cb59ce88f2c0293437d06bd1515749fab86
- SSDEEP 393216:/+S+JEKUxqnvQbntd78v4Mn/R1FtWXEOThs2K:m9tUxgvOj7ZM/LbWXFHK
- TLSH T1A707BEF68C705691FE3A4C34DEA1AA648D357C291F908BCF2905B18B67736F7603D289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-03_4df29eff27367e74db5c038404250fb5_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_4df29eff27367e74db5c038404250fb5_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe
Resource
win11ltsc2024-20260629-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-03_4df29eff27367e74db5c038404250fb5_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_stealc_vidar
- Size 16.2MB
- SHA256 15666a87c06f779ebc8c4bb1f603d3a3724605b4c6e8ec7b834dfb0f7ea471f0
- MD5 4df29eff27367e74db5c038404250fb5
- SHA1 50422e8ea517ca1b70b2ec21319956e087948093
- SHA512 36460c21f33f2a156db428847a3cbfac03dfd67a5f899c158efacd9d0dccd88bbc82bd0f2446da2e2a09f96cbc476cb59ce88f2c0293437d06bd1515749fab86
- SSDEEP 393216:/+S+JEKUxqnvQbntd78v4Mn/R1FtWXEOThs2K:m9tUxgvOj7ZM/LbWXFHK
- TLSH T1A707BEF68C705691FE3A4C34DEA1AA648D357C291F908BCF2905B18B67736F7603D289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10Detects KawaiiUnicorn
- Custom signature
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Custom signature
UPX dump on OEP (original entry point)
Executes dropped EXE
Drops file in System32 directory