General
- Target 2026-07-14_3f85b33ba90be96ebe533e723bdb13d4_akira_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_njrat_remcos_stealc_vidar_wannacry
- Size 27.6MB
- Sample260714-2ddknaey6m
- SHA256 76bfc843cd522903a0c6a1d18ebf74e1dcdfcbe77c1623c943c2a2801a017997
- MD5 3f85b33ba90be96ebe533e723bdb13d4
- SHA1 992d33ec234545873dedc29fbc3a7a00d59ea301
- SHA512 a840e274ff4f3704a73335ca296ead3469414cc23d69309a0de27e0d8d53c8c397ab19493820b7c5ce58763f47ae833b0ea3bdfec41b87570de5983b334e85e8
- SSDEEP 393216:dH2VQKu/v1LLJbf3qGTZs396XJsQXI3kGYt+cNSG/lVCISOJEKUxqnvQbntd78vi:dH26LJ4M/qkR+gVttUxgvOj7ZM/A
- TLSH T1DD57CFA2997002E1FE7A8834DE526A26D9317C094F609BCF399CB55F2B736F2543E344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-14_3f85b33ba90be96ebe533e723bdb13d4_akira_cobalt-strike_coinminer_darkgate_elex_gcleaner_gla.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_3f85b33ba90be96ebe533e723bdb13d4_akira_cobalt-strike_coinminer_darkgate_elex_gcleaner_gla.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_3f85b33ba90be96ebe533e723bdb13d4_akira_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_njrat_remcos_stealc_vidar_wannacry
- Size 27.6MB
- SHA256 76bfc843cd522903a0c6a1d18ebf74e1dcdfcbe77c1623c943c2a2801a017997
- MD5 3f85b33ba90be96ebe533e723bdb13d4
- SHA1 992d33ec234545873dedc29fbc3a7a00d59ea301
- SHA512 a840e274ff4f3704a73335ca296ead3469414cc23d69309a0de27e0d8d53c8c397ab19493820b7c5ce58763f47ae833b0ea3bdfec41b87570de5983b334e85e8
- SSDEEP 393216:dH2VQKu/v1LLJbf3qGTZs396XJsQXI3kGYt+cNSG/lVCISOJEKUxqnvQbntd78vi:dH26LJ4M/qkR+gVttUxgvOj7ZM/A
- TLSH T1DD57CFA2997002E1FE7A8834DE526A26D9317C094F609BCF399CB55F2B736F2543E344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing possible sandbox analysis VM usernames
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE