General
- Target 2026-07-16_d6fb217ad89929e28184c4d6d475e8f4_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260716-d8r5jacv2p
- SHA256 078475e52475f08f2394f0cbe00c6cadf30f3b8fe0d414b7ee89e5a46c1df705
- MD5 d6fb217ad89929e28184c4d6d475e8f4
- SHA1 b7effd466a58bb1521819c304b60d848a0957a11
- SHA512 0b082be3a1e7c871191de3c68eb05099874096177a0bc6d6b51456dd89f36e551ff8f20b180ea2a6c5a8a0a65c68a78682ca69a834ad43ee91ee539009ba6489
- SSDEEP 196608:EP0vi/MZ/R15fmmpL4HgWKL6qwSLTK+ZrXcB3tTd1n5ZjmxcO4TjV2VNtpPJ1mWH:E8v4MZ/R1FtGXE9ThsrtEk2NDJsW
- TLSH T1BCD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-16_d6fb217ad89929e28184c4d6d475e8f4_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_d6fb217ad89929e28184c4d6d475e8f4_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-16_d6fb217ad89929e28184c4d6d475e8f4_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 078475e52475f08f2394f0cbe00c6cadf30f3b8fe0d414b7ee89e5a46c1df705
- MD5 d6fb217ad89929e28184c4d6d475e8f4
- SHA1 b7effd466a58bb1521819c304b60d848a0957a11
- SHA512 0b082be3a1e7c871191de3c68eb05099874096177a0bc6d6b51456dd89f36e551ff8f20b180ea2a6c5a8a0a65c68a78682ca69a834ad43ee91ee539009ba6489
- SSDEEP 196608:EP0vi/MZ/R15fmmpL4HgWKL6qwSLTK+ZrXcB3tTd1n5ZjmxcO4TjV2VNtpPJ1mWH:E8v4MZ/R1FtGXE9ThsrtEk2NDJsW
- TLSH T1BCD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE