General
- Target 2026-07-05_b435abbfb1098eeb10c5b3c6577c18e9_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260705-vldgashz4l
- SHA256 ed2e6326b080fda678799518f519cc01b7fa32fbf082e782c203f35f1c82f3a2
- MD5 b435abbfb1098eeb10c5b3c6577c18e9
- SHA1 5f0ff902c6a1c4e37b3be198ee85b3fee5a40b51
- SHA512 cb03e83e70b668e0e69108be868e62265aecd03943291c3e7f0193ca6d5011f5912c55a3e2f94bcac85e26471a5f59beb3ee01565806a50c8c34bee7b63cd006
- SSDEEP 196608:EI0vi/Mn/R15fmm6LIHgWKLaqwyLTK+ZIXqB3tTdXn5ZjBxcO4TjV2VNgLPy1mkH:Exv4Mn/R1FGmXE9Tu6rfJk2Ngysk
- TLSH T19DD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-05_b435abbfb1098eeb10c5b3c6577c18e9_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_b435abbfb1098eeb10c5b3c6577c18e9_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260630-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-05_b435abbfb1098eeb10c5b3c6577c18e9_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 ed2e6326b080fda678799518f519cc01b7fa32fbf082e782c203f35f1c82f3a2
- MD5 b435abbfb1098eeb10c5b3c6577c18e9
- SHA1 5f0ff902c6a1c4e37b3be198ee85b3fee5a40b51
- SHA512 cb03e83e70b668e0e69108be868e62265aecd03943291c3e7f0193ca6d5011f5912c55a3e2f94bcac85e26471a5f59beb3ee01565806a50c8c34bee7b63cd006
- SSDEEP 196608:EI0vi/Mn/R15fmm6LIHgWKLaqwyLTK+ZIXqB3tTdXn5ZjBxcO4TjV2VNgLPy1mkH:Exv4Mn/R1FGmXE9Tu6rfJk2Ngysk
- TLSH T19DD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE