General
- Target 2026-07-15_6cf72abe20ade6aa92e32519d6fda50e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260715-w96nesbz4j
- SHA256 b0ee9059e2c064e5f4df5892a6094d5de684276033e008852e140a9eb99fc8ad
- MD5 6cf72abe20ade6aa92e32519d6fda50e
- SHA1 57c37bc0c2b713d92fba6a5b76107f9ef8fe98af
- SHA512 9b680dc6e5b4ea7c732cf12b51e3ad8039bf0a3665114dfed3eb4c01a50e0d5771082e0987fc381c85ec0360d5ba0b5fa8eee60168681c4ec7d6421d63ee8f39
- SSDEEP 196608:EP6Yi/Mn/R15fmmSLDHgWXLxqw6L2K+ZtXcB3t3dgn5ZjBxcO4T0V2VNgIwx1m6H:EiY4Mn/R1F+nX7g2fs/6JB2Nwxs6
- TLSH T17FD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-15_6cf72abe20ade6aa92e32519d6fda50e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_6cf72abe20ade6aa92e32519d6fda50e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-15_6cf72abe20ade6aa92e32519d6fda50e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 b0ee9059e2c064e5f4df5892a6094d5de684276033e008852e140a9eb99fc8ad
- MD5 6cf72abe20ade6aa92e32519d6fda50e
- SHA1 57c37bc0c2b713d92fba6a5b76107f9ef8fe98af
- SHA512 9b680dc6e5b4ea7c732cf12b51e3ad8039bf0a3665114dfed3eb4c01a50e0d5771082e0987fc381c85ec0360d5ba0b5fa8eee60168681c4ec7d6421d63ee8f39
- SSDEEP 196608:EP6Yi/Mn/R15fmmSLDHgWXLxqw6L2K+ZtXcB3t3dgn5ZjBxcO4T0V2VNgIwx1m6H:EiY4Mn/R1F+nX7g2fs/6JB2Nwxs6
- TLSH T17FD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10Detects KawaiiUnicorn
- Custom signature
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Custom signature
UPX dump on OEP (original entry point)
Executes dropped EXE