General
- Target 2026-07-15_757770e9dd83dbd87c6f52295393ff32_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260715-w79bjaby6p
- SHA256 b55e7d31db1976e84e4d37ef1a66ab6d1a66641fe4ffaf655627f1ed54485d2d
- MD5 757770e9dd83dbd87c6f52295393ff32
- SHA1 23d0242de6274fc2c42cfffe46bd411ec671a0f0
- SHA512 459efd509759974e9a39fe5640d677eccbd538e49b067ccaeac95b9d6ff5d0ec98ab6eb6e6f7be25cc0dc6f9332a50f075e33ca9362bc1c994a3910b47700f1a
- SSDEEP 196608:EP0vi/Mn/R15fmmpLAHgWKL6qw5LTK+ZrXcBstTdgn5ZjBxcO4TjV2VNgRDJ1mvH:E8v4Mn/R1Ft+XEOThs26Jk2NyJsv
- TLSH T184D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-15_757770e9dd83dbd87c6f52295393ff32_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_757770e9dd83dbd87c6f52295393ff32_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-15_757770e9dd83dbd87c6f52295393ff32_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 b55e7d31db1976e84e4d37ef1a66ab6d1a66641fe4ffaf655627f1ed54485d2d
- MD5 757770e9dd83dbd87c6f52295393ff32
- SHA1 23d0242de6274fc2c42cfffe46bd411ec671a0f0
- SHA512 459efd509759974e9a39fe5640d677eccbd538e49b067ccaeac95b9d6ff5d0ec98ab6eb6e6f7be25cc0dc6f9332a50f075e33ca9362bc1c994a3910b47700f1a
- SSDEEP 196608:EP0vi/Mn/R15fmmpLAHgWKL6qw5LTK+ZrXcBstTdgn5ZjBxcO4TjV2VNgRDJ1mvH:E8v4Mn/R1Ft+XEOThs26Jk2NyJsv
- TLSH T184D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE