General
- Target 2026-07-12_04d85681cb1b35418a03928d453e8926_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260712-rysj7sdx7y
- SHA256 74a68a197d32876bcd3cf81a983f2dce5b64ce1b033ce3c7feddf766b4bf9b73
- MD5 04d85681cb1b35418a03928d453e8926
- SHA1 af065bf138b93fc785adce71fff848797e01be1b
- SHA512 dc201c1f5a407b2cc62c2573134abfc14d31995c254d2dfc6b282e249e50d3fca7f7ce9e9bd53c0e38256d1973f4233550e771a50ac8bd94bb0c169280f31388
- SSDEEP 196608:EP6Ym/Mn/R15fmmZLGHKhKLYqw5LTK+ZtX7BKtTd6n5ZjBxcO4csV2VNgDvB1m+H:EiY0Mn/R1Fdc+E8Tfr0IJk2NIBs+
- TLSH T1E1D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-12_04d85681cb1b35418a03928d453e8926_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_04d85681cb1b35418a03928d453e8926_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-12_04d85681cb1b35418a03928d453e8926_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 74a68a197d32876bcd3cf81a983f2dce5b64ce1b033ce3c7feddf766b4bf9b73
- MD5 04d85681cb1b35418a03928d453e8926
- SHA1 af065bf138b93fc785adce71fff848797e01be1b
- SHA512 dc201c1f5a407b2cc62c2573134abfc14d31995c254d2dfc6b282e249e50d3fca7f7ce9e9bd53c0e38256d1973f4233550e771a50ac8bd94bb0c169280f31388
- SSDEEP 196608:EP6Ym/Mn/R15fmmZLGHKhKLYqw5LTK+ZtX7BKtTd6n5ZjBxcO4csV2VNgDvB1m+H:EiY0Mn/R1Fdc+E8Tfr0IJk2NIBs+
- TLSH T1E1D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE