General
- Target 2026-07-09_c9cc863637d8473c2b0b35fe33f7eb21_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 17.7MB
- Sample260709-jvlcqaew5m
- SHA256 78ca11721b2630053a04c83a52b514283dd7e42af17bbef5b5cdc7de96bb4e8e
- MD5 c9cc863637d8473c2b0b35fe33f7eb21
- SHA1 b7661d2667fdc58b943c2e068d16ffc7957d76e7
- SHA512 8a37c801ddb87956129596d1ab0db6c54d9a87c2c8e7dcfdf67c7dd0b4a49baf0bef2cda2ece576467ce43ee0e0c179aeffdf0d664d8657d00de7fb4e6da24ca
- SSDEEP 393216:RJEKUxqnjQbntuF8v4Mn/R1Ft+XEiThz26Jk2NuJsv:RtUxgjOUFZM/Lb+Xp86Jk2Aw
- TLSH T12B170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-09_c9cc863637d8473c2b0b35fe33f7eb21_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_c9cc863637d8473c2b0b35fe33f7eb21_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260706-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_c9cc863637d8473c2b0b35fe33f7eb21_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 17.7MB
- SHA256 78ca11721b2630053a04c83a52b514283dd7e42af17bbef5b5cdc7de96bb4e8e
- MD5 c9cc863637d8473c2b0b35fe33f7eb21
- SHA1 b7661d2667fdc58b943c2e068d16ffc7957d76e7
- SHA512 8a37c801ddb87956129596d1ab0db6c54d9a87c2c8e7dcfdf67c7dd0b4a49baf0bef2cda2ece576467ce43ee0e0c179aeffdf0d664d8657d00de7fb4e6da24ca
- SSDEEP 393216:RJEKUxqnjQbntuF8v4Mn/R1Ft+XEiThz26Jk2NuJsv:RtUxgjOUFZM/Lb+Xp86Jk2Aw
- TLSH T12B170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE