General
- Target 2026-07-14_6ecd150f39728d13bfbe6007c2027bfd_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 13.0MB
- Sample260715-a3zqmsgw7k
- SHA256 43617af5bb3d3828bd2d7801f3208dde3cccf8bdc66ae8104daf26c9f5ab1de9
- MD5 6ecd150f39728d13bfbe6007c2027bfd
- SHA1 0086ec199ecf916577e4b3b90e19db99f822e010
- SHA512 2020fcbda778a87e8bf3ac7ac406250213b5d11bb69d7d9d15d1810a2731019a30d788852ca4212a24e69c46aa822c3d73979c0e3949ffecf0eb0e3729c9d066
- SSDEEP 196608:7NenLDPyppqMP0vi/Mn/R15fmmpLAHgWKL6qwELTK+Zr9sBstTdgn5ZjBxcO4Tj:penfy78v4Mn/R1Ft+XEHTh+26Jk2
- TLSH T14AD6F126AAA00FA5F433813407B6C566D63A7C3A172087CF7358F65A2F736D1583E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-14_6ecd150f39728d13bfbe6007c2027bfd_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_6ecd150f39728d13bfbe6007c2027bfd_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_6ecd150f39728d13bfbe6007c2027bfd_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 13.0MB
- SHA256 43617af5bb3d3828bd2d7801f3208dde3cccf8bdc66ae8104daf26c9f5ab1de9
- MD5 6ecd150f39728d13bfbe6007c2027bfd
- SHA1 0086ec199ecf916577e4b3b90e19db99f822e010
- SHA512 2020fcbda778a87e8bf3ac7ac406250213b5d11bb69d7d9d15d1810a2731019a30d788852ca4212a24e69c46aa822c3d73979c0e3949ffecf0eb0e3729c9d066
- SSDEEP 196608:7NenLDPyppqMP0vi/Mn/R15fmmpLAHgWKL6qwELTK+Zr9sBstTdgn5ZjBxcO4Tj:penfy78v4Mn/R1Ft+XEHTh+26Jk2
- TLSH T14AD6F126AAA00FA5F433813407B6C566D63A7C3A172087CF7358F65A2F736D1583E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE