General
- Target 2026-07-07_00826388bbbb458c81aede6631847112_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260707-3skg7af191
- SHA256 e57cd17e363ab78dd979d78d0f83035504afc738866f6c40f3e365ef2c0568ae
- MD5 00826388bbbb458c81aede6631847112
- SHA1 cdb5dfc07ac25df27b4085381e38d8c2a1754b8d
- SHA512 32c2151bab302422343f66783b82888016804a9b199ab7fe0ac3004da1bf8b6c2530374c184d2e50a1353e2ada3a09e4656aa89cd02d9fcb830a716000c5d315
- SSDEEP 196608:EP0vi/Mn/O1/fmmpmDHgWKL6qw5LTK+Z1u4B31NdgToZjGxcO4k3V2VNIrPS1meH:E8v4Mn/O1HtKXEOTnr9XcN2NoSse
- TLSH T156D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-07_00826388bbbb458c81aede6631847112_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_00826388bbbb458c81aede6631847112_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260706-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-07_00826388bbbb458c81aede6631847112_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 e57cd17e363ab78dd979d78d0f83035504afc738866f6c40f3e365ef2c0568ae
- MD5 00826388bbbb458c81aede6631847112
- SHA1 cdb5dfc07ac25df27b4085381e38d8c2a1754b8d
- SHA512 32c2151bab302422343f66783b82888016804a9b199ab7fe0ac3004da1bf8b6c2530374c184d2e50a1353e2ada3a09e4656aa89cd02d9fcb830a716000c5d315
- SSDEEP 196608:EP0vi/Mn/O1/fmmpmDHgWKL6qw5LTK+Z1u4B31NdgToZjGxcO4k3V2VNIrPS1meH:E8v4Mn/O1HtKXEOTnr9XcN2NoSse
- TLSH T156D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE