General
- Target 2026-07-11_52cf1fad6c956a8bb7272c150fe3063d_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260711-xa2e4ahs8r
- SHA256 8278a772efa5c3495fb9123e66e357cbb963af585fb54751516de0a2b3e203a2
- MD5 52cf1fad6c956a8bb7272c150fe3063d
- SHA1 121fd0be74210379618c3b8b156516ed4b9b6542
- SHA512 af55fc300c901ded6c3a1fdc93993e72e5471385f3a9784d77406a7d5442394f5c8d7a08f532af58716db29aba24cd25d959bcee5c4a6a696e797eac512e522a
- SSDEEP 196608:EP6Yi/Mn/R15fmmiLqHgWKLOqw5LTK+ZGzcB3tTdgn5ZjBxcO4cnV2VNgAiJ1Z+H:EiY4Mn/R1F2AXESTQgr6Jt2NqJz+
- TLSH T106D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-11_52cf1fad6c956a8bb7272c150fe3063d_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_52cf1fad6c956a8bb7272c150fe3063d_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-11_52cf1fad6c956a8bb7272c150fe3063d_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 8278a772efa5c3495fb9123e66e357cbb963af585fb54751516de0a2b3e203a2
- MD5 52cf1fad6c956a8bb7272c150fe3063d
- SHA1 121fd0be74210379618c3b8b156516ed4b9b6542
- SHA512 af55fc300c901ded6c3a1fdc93993e72e5471385f3a9784d77406a7d5442394f5c8d7a08f532af58716db29aba24cd25d959bcee5c4a6a696e797eac512e522a
- SSDEEP 196608:EP6Yi/Mn/R15fmmiLqHgWKLOqw5LTK+ZGzcB3tTdgn5ZjBxcO4cnV2VNgAiJ1Z+H:EiY4Mn/R1F2AXESTQgr6Jt2NqJz+
- TLSH T106D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE