General
- Target 2026-07-14_437df2990d2d266d7610f591e4373556_agent-tesla_akira_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_loki-bot_njrat_remcos_stealc_vidar_wannacry
- Size 29.2MB
- Sample260714-2cc8haey4l
- SHA256 0a21c08cf5df49ada298ac7124df1b9ff5f3253efb31083fbac2631aa5c72751
- MD5 437df2990d2d266d7610f591e4373556
- SHA1 7b279d2e75c6699115344d829ee99df87c373d0b
- SHA512 777ae277b4e08bfb06477ec0d4d738bdf7129c54142dfac9b8cdd641e62720464d09da405ddcc7c6a5c050e26296107dbb79fd0a9f3118bd08c36d7a562cc514
- SSDEEP 393216:dHEVQKu/v1LLJbf3qGTZs396UJsQXI3kGYt+cNSG/lVCISOJEKUxqnvQbnCd78vF:dHE6LJ4v/qkR+gVttUxgvOi7ZM/Lbz
- TLSH T18767D0A6997002E1FE7A8834DE52A526D9317C190F608BCF3A9CB65F1B736F2543E344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-14_437df2990d2d266d7610f591e4373556_agent-tesla_akira_cobalt-strike_coinminer_darkgate_elex_.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_437df2990d2d266d7610f591e4373556_agent-tesla_akira_cobalt-strike_coinminer_darkgate_elex_.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_437df2990d2d266d7610f591e4373556_agent-tesla_akira_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_loki-bot_njrat_remcos_stealc_vidar_wannacry
- Size 29.2MB
- SHA256 0a21c08cf5df49ada298ac7124df1b9ff5f3253efb31083fbac2631aa5c72751
- MD5 437df2990d2d266d7610f591e4373556
- SHA1 7b279d2e75c6699115344d829ee99df87c373d0b
- SHA512 777ae277b4e08bfb06477ec0d4d738bdf7129c54142dfac9b8cdd641e62720464d09da405ddcc7c6a5c050e26296107dbb79fd0a9f3118bd08c36d7a562cc514
- SSDEEP 393216:dHEVQKu/v1LLJbf3qGTZs396UJsQXI3kGYt+cNSG/lVCISOJEKUxqnvQbnCd78vF:dHE6LJ4v/qkR+gVttUxgvOi7ZM/Lbz
- TLSH T18767D0A6997002E1FE7A8834DE52A526D9317C190F608BCF3A9CB65F1B736F2543E344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing possible sandbox analysis VM usernames
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE