General
- Target 2026-07-05_59fa83e925f5c61ad138e1630be75252_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260705-vqqbnaet2v
- SHA256 d2a248c94f0d0ee0987a1b77fb5e33b974710acebfd95deb0d64f9e47ec71555
- MD5 59fa83e925f5c61ad138e1630be75252
- SHA1 8f8a3444601ae34448a10ca60ef97414178c01c4
- SHA512 5ca4eff919f79dcfa1275a1dd7ad6b61e5c6703f73ac511b1a7dc013896f6c7a9607bc7bb5df8371643cc6a6c626e2e12e90aea7aea6e436d3c1dddbcf9bfd8f
- SSDEEP 196608:EPcgi/Mn/R15fmmpLD9g4KL9qwSLeK+ZrXFB3tTdgV5ZjcxcO4TjV2V3/ePm1m+H:EUg4Mn/R1FtdBEceh1rgWk23qms+
- TLSH T1FDD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-05_59fa83e925f5c61ad138e1630be75252_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_59fa83e925f5c61ad138e1630be75252_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260629-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-05_59fa83e925f5c61ad138e1630be75252_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 d2a248c94f0d0ee0987a1b77fb5e33b974710acebfd95deb0d64f9e47ec71555
- MD5 59fa83e925f5c61ad138e1630be75252
- SHA1 8f8a3444601ae34448a10ca60ef97414178c01c4
- SHA512 5ca4eff919f79dcfa1275a1dd7ad6b61e5c6703f73ac511b1a7dc013896f6c7a9607bc7bb5df8371643cc6a6c626e2e12e90aea7aea6e436d3c1dddbcf9bfd8f
- SSDEEP 196608:EPcgi/Mn/R15fmmpLD9g4KL9qwSLeK+ZrXFB3tTdgV5ZjcxcO4TjV2V3/ePm1m+H:EUg4Mn/R1FtdBEceh1rgWk23qms+
- TLSH T1FDD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE