General
- Target 2026-07-12_5c8e3673e0ad063e8c3fe2844d2a973f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 15.7MB
- Sample260712-x1a1tsfy7n
- SHA256 b6db381d1b05792fb297fe19d12d242b6b6f99de7c31645d993b2e275e9be69a
- MD5 5c8e3673e0ad063e8c3fe2844d2a973f
- SHA1 015897c8f2deac39fb50cf1e656ae1351269d56b
- SHA512 e2b76a324c7d0b6dd056c2aee03d76e5f5e5d6b7c5253fe2194fdc478d73a275edca40b03924573ee36271d872e14f62d64186dc353faa4bb4f30524b160ae24
- SSDEEP 393216:pbn7d3Lv4Mn/R1Ftu6EhThvi6JJ2NzJs+:9p3EM/Lbu6Kg6JJ2pZ
- TLSH T18CF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-12_5c8e3673e0ad063e8c3fe2844d2a973f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_5c8e3673e0ad063e8c3fe2844d2a973f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-12_5c8e3673e0ad063e8c3fe2844d2a973f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 15.7MB
- SHA256 b6db381d1b05792fb297fe19d12d242b6b6f99de7c31645d993b2e275e9be69a
- MD5 5c8e3673e0ad063e8c3fe2844d2a973f
- SHA1 015897c8f2deac39fb50cf1e656ae1351269d56b
- SHA512 e2b76a324c7d0b6dd056c2aee03d76e5f5e5d6b7c5253fe2194fdc478d73a275edca40b03924573ee36271d872e14f62d64186dc353faa4bb4f30524b160ae24
- SSDEEP 393216:pbn7d3Lv4Mn/R1Ftu6EhThvi6JJ2NzJs+:9p3EM/Lbu6Kg6JJ2pZ
- TLSH T18CF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE