General
- Target 2026-07-14_f5dd3523f6513fffd02c22f5454dc521_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260714-pj7dpsex2x
- SHA256 fecd169eb88d85eae0ff578880482db7b73a3c908dcd9c715c4532b6c13251aa
- MD5 f5dd3523f6513fffd02c22f5454dc521
- SHA1 5296fdd964bd50dbda8f56af99e58f578da924a4
- SHA512 14e1b6a672b97781eef5376c31fe0e45f39db918418b02651281ef476ef171d4b452ff001410737f99da6842b5afb94c1762368d65d240087f4acbdc44ad137c
- SSDEEP 196608:EPjvi4Mn/Y15fmmpL1HgWKL6qw5LTK+ZrsDBQ3TdgE5ZjBxcO4TjV2VNg/PJ1Y+H:ELv/Mn/Y1FtxXEOTh+UpJk2NkJS+
- TLSH T172D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-14_f5dd3523f6513fffd02c22f5454dc521_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_f5dd3523f6513fffd02c22f5454dc521_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_f5dd3523f6513fffd02c22f5454dc521_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 fecd169eb88d85eae0ff578880482db7b73a3c908dcd9c715c4532b6c13251aa
- MD5 f5dd3523f6513fffd02c22f5454dc521
- SHA1 5296fdd964bd50dbda8f56af99e58f578da924a4
- SHA512 14e1b6a672b97781eef5376c31fe0e45f39db918418b02651281ef476ef171d4b452ff001410737f99da6842b5afb94c1762368d65d240087f4acbdc44ad137c
- SSDEEP 196608:EPjvi4Mn/Y15fmmpL1HgWKL6qw5LTK+ZrsDBQ3TdgE5ZjBxcO4TjV2VNg/PJ1Y+H:ELv/Mn/Y1FtxXEOTh+UpJk2NkJS+
- TLSH T172D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE