General
- Target 2026-07-14_f214f75c7b43d9a0b5e1bf2d692ab564_akira_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_njrat_remcos_stealc_vidar_wannacry
- Size 27.6MB
- Sample260714-zypsbadx4m
- SHA256 e43789dfddb45a66ed4bc228b5db62f66c9c570391ca632427330dd9da44569c
- MD5 f214f75c7b43d9a0b5e1bf2d692ab564
- SHA1 0ae527d100b5862c08de53a70883c50041f27c85
- SHA512 f15d3de4a1826ab67e097a51bc9ff0b7293a7022d722da2cfdc7b8dc36c1a62eeeeaea4183df7650587b5d4cd0f8af954285d3cd7602af08f4e6277c7314d21e
- SSDEEP 393216:dHEVQKu/v1LLJbf3qGTZs396UJsQXI3kGYt+cNSG/lVCISOJEKUxqnvQbnCd78vs:dHE6LJ4v/qkR+gVttUxgvOi7ZM/u
- TLSH T1BD57CFA2997002E1FE7A8834DE526A26D9317C094F609BCF399CB55F2B736F2543E344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-14_f214f75c7b43d9a0b5e1bf2d692ab564_akira_cobalt-strike_coinminer_darkgate_elex_gcleaner_gla.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_f214f75c7b43d9a0b5e1bf2d692ab564_akira_cobalt-strike_coinminer_darkgate_elex_gcleaner_gla.exe
Resource
win11ltsc2024-20260710-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_f214f75c7b43d9a0b5e1bf2d692ab564_akira_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_njrat_remcos_stealc_vidar_wannacry
- Size 27.6MB
- SHA256 e43789dfddb45a66ed4bc228b5db62f66c9c570391ca632427330dd9da44569c
- MD5 f214f75c7b43d9a0b5e1bf2d692ab564
- SHA1 0ae527d100b5862c08de53a70883c50041f27c85
- SHA512 f15d3de4a1826ab67e097a51bc9ff0b7293a7022d722da2cfdc7b8dc36c1a62eeeeaea4183df7650587b5d4cd0f8af954285d3cd7602af08f4e6277c7314d21e
- SSDEEP 393216:dHEVQKu/v1LLJbf3qGTZs396UJsQXI3kGYt+cNSG/lVCISOJEKUxqnvQbnCd78vs:dHE6LJ4v/qkR+gVttUxgvOi7ZM/u
- TLSH T1BD57CFA2997002E1FE7A8834DE526A26D9317C094F609BCF399CB55F2B736F2543E344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing possible sandbox analysis VM usernames
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE