General
- Target 2026-07-16_5dcb3b388ca46cf0e4b1d7221731e66b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260716-eahc4scv8p
- SHA256 02a7cb2e7ff8c49ffc529b8a0b2c74171ff810dc02a306f117c3d8c4ec21e0b6
- MD5 5dcb3b388ca46cf0e4b1d7221731e66b
- SHA1 75bc18c0dd85cbf39f0ff8ed15c5c4826e3bb63a
- SHA512 f036fc42bd221218a7bf2d2dc821037d142443a787507a6fab7cebefecbcf3351fd3ae4696b33dc54792a9d8a2ec7cf36bc8dd9016716f620295eaa3de55d6cb
- SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKLpqwSLTK+ZIXcB38+dXn5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p1Ztn/EYTusBfJ02NzJs+
- TLSH T149D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-16_5dcb3b388ca46cf0e4b1d7221731e66b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_5dcb3b388ca46cf0e4b1d7221731e66b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-16_5dcb3b388ca46cf0e4b1d7221731e66b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 02a7cb2e7ff8c49ffc529b8a0b2c74171ff810dc02a306f117c3d8c4ec21e0b6
- MD5 5dcb3b388ca46cf0e4b1d7221731e66b
- SHA1 75bc18c0dd85cbf39f0ff8ed15c5c4826e3bb63a
- SHA512 f036fc42bd221218a7bf2d2dc821037d142443a787507a6fab7cebefecbcf3351fd3ae4696b33dc54792a9d8a2ec7cf36bc8dd9016716f620295eaa3de55d6cb
- SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKLpqwSLTK+ZIXcB38+dXn5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p1Ztn/EYTusBfJ02NzJs+
- TLSH T149D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10Detects KawaiiUnicorn
- Custom signature
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Custom signature
UPX dump on OEP (original entry point)
Executes dropped EXE