General
- Target 2026-07-14_a7eac95463c56dd84f9923d8c071b76f_agent-tesla_akira_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_loki-bot_njrat_remcos_stealc_vidar_wannacry
- Size 29.8MB
- Sample260714-1kn5ases4r
- SHA256 ce92e729ce6cb1cb00e14d8726a18d861bc92f92078240b848da0841b0dff1db
- MD5 a7eac95463c56dd84f9923d8c071b76f
- SHA1 ee7769313b5b1bbac2f341fcb5189ffc5a88cb15
- SHA512 dea707daecd82863044ebbba7d457380ba4ce4236754bd366a02210f4c7922ca689a4deb863d37b2df68a8c38607f55b93be6ed5eed63e6eec232b394b2fc747
- SSDEEP 393216:dHEVQKu/v1LLJbf3qGTZs396XJsQXI3kGYt+cNSG/lVCISOJEKUxqnvQbnCd78vW:dHE6LJ4M/qkR+gVttUxgvOi7ZM/LbnXM
- TLSH T1EF67D0A6997002E1FE7A8834CE52A526D9317C194B608BCF3A9CB65F1B737F2543E344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-14_a7eac95463c56dd84f9923d8c071b76f_agent-tesla_akira_cobalt-strike_coinminer_darkgate_elex_.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_a7eac95463c56dd84f9923d8c071b76f_agent-tesla_akira_cobalt-strike_coinminer_darkgate_elex_.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_a7eac95463c56dd84f9923d8c071b76f_agent-tesla_akira_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_loki-bot_njrat_remcos_stealc_vidar_wannacry
- Size 29.8MB
- SHA256 ce92e729ce6cb1cb00e14d8726a18d861bc92f92078240b848da0841b0dff1db
- MD5 a7eac95463c56dd84f9923d8c071b76f
- SHA1 ee7769313b5b1bbac2f341fcb5189ffc5a88cb15
- SHA512 dea707daecd82863044ebbba7d457380ba4ce4236754bd366a02210f4c7922ca689a4deb863d37b2df68a8c38607f55b93be6ed5eed63e6eec232b394b2fc747
- SSDEEP 393216:dHEVQKu/v1LLJbf3qGTZs396XJsQXI3kGYt+cNSG/lVCISOJEKUxqnvQbnCd78vW:dHE6LJ4M/qkR+gVttUxgvOi7ZM/LbnXM
- TLSH T1EF67D0A6997002E1FE7A8834CE52A526D9317C194B608BCF3A9CB65F1B737F2543E344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing possible sandbox analysis VM usernames
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE