General
- Target 2026-07-17_432b7b758425517e393e016d61730445_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260718-epgecsfy6p
- SHA256 ca991ecea30b1cd33038d393337a7d71717e7876e73cf93c70581687c9401d86
- MD5 432b7b758425517e393e016d61730445
- SHA1 89215fd1b7a9ab5ba2ec8e1625346f717dde0cd0
- SHA512 1dffa3ecf12a73b362ad7657b0e19ea455f3bc84c9b957a920fcd700e0b1e640748cf35911bc9a981156fe676b68976641acc9526247db5bb1ed5c0b4729c54b
- SSDEEP 196608:EP0vi/Mn/215fVmpLTHgWKLMqwqL+K+ZrGUB869dgi5ZjBxcO4z1J2VNkWPJ1m+H:E8v4Mn/21F6/XEP+hbhfJe2N1Js+
- TLSH T170D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-17_432b7b758425517e393e016d61730445_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_432b7b758425517e393e016d61730445_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-17_432b7b758425517e393e016d61730445_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 ca991ecea30b1cd33038d393337a7d71717e7876e73cf93c70581687c9401d86
- MD5 432b7b758425517e393e016d61730445
- SHA1 89215fd1b7a9ab5ba2ec8e1625346f717dde0cd0
- SHA512 1dffa3ecf12a73b362ad7657b0e19ea455f3bc84c9b957a920fcd700e0b1e640748cf35911bc9a981156fe676b68976641acc9526247db5bb1ed5c0b4729c54b
- SSDEEP 196608:EP0vi/Mn/215fVmpLTHgWKLMqwqL+K+ZrGUB869dgi5ZjBxcO4z1J2VNkWPJ1m+H:E8v4Mn/21F6/XEP+hbhfJe2N1Js+
- TLSH T170D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE