General
- Target 2026-07-17_6bf5c7147bf9cef1089da2fedbffe286_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_stealc_vidar
- Size 12.1MB
- Sample260717-xptc2afv9s
- SHA256 34d809f920e92ae069ba73820b6445a0bbe22d0d3f93f1ca8ed068a44622a824
- MD5 6bf5c7147bf9cef1089da2fedbffe286
- SHA1 3916e863c4cd4d9fbef35cc6fc01e8ab148f6e25
- SHA512 439b1482c87f420d61337c241c9a0e0d27a8214591fb0aede2b2ec910cba1126f8a2a3a501f2eb6e6175e3140cdf47340cccdbb40ee3fb6fc8282cf3258f20ca
- SSDEEP 196608:7N9nLDkdppqMP0vi/Mn/R1GfmmpLiHgWKL6kw5LTK+ZrXck3rTdgn5ZjBxcO47:p9n0d78v4Mn/R1MtgXE4Thsm6JE
- TLSH T1CAD6F126DAA01FA5F833413403A6C566DA2A7C3A532047CF779CFA563BB32D1153E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-17_6bf5c7147bf9cef1089da2fedbffe286_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_6bf5c7147bf9cef1089da2fedbffe286_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-17_6bf5c7147bf9cef1089da2fedbffe286_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_stealc_vidar
- Size 12.1MB
- SHA256 34d809f920e92ae069ba73820b6445a0bbe22d0d3f93f1ca8ed068a44622a824
- MD5 6bf5c7147bf9cef1089da2fedbffe286
- SHA1 3916e863c4cd4d9fbef35cc6fc01e8ab148f6e25
- SHA512 439b1482c87f420d61337c241c9a0e0d27a8214591fb0aede2b2ec910cba1126f8a2a3a501f2eb6e6175e3140cdf47340cccdbb40ee3fb6fc8282cf3258f20ca
- SSDEEP 196608:7N9nLDkdppqMP0vi/Mn/R1GfmmpLiHgWKL6kw5LTK+ZrXck3rTdgn5ZjBxcO47:p9n0d78v4Mn/R1MtgXE4Thsm6JE
- TLSH T1CAD6F126DAA01FA5F833413403A6C566DA2A7C3A532047CF779CFA563BB32D1153E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10Detects KawaiiUnicorn
- Custom signature
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Custom signature
UPX dump on OEP (original entry point)
Executes dropped EXE