General
- Target 2026-07-17_370e6b288038da411dcedb5c39fc2b9e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 17.7MB
- Sample260718-ewjs3af16r
- SHA256 e8abdadc4852e7a2cb8b565ab67cb41a89914cecc2fe5d05c02d9b4b9bf4d5a2
- MD5 370e6b288038da411dcedb5c39fc2b9e
- SHA1 9555de9c96b26243919ba016ff648043bcbb2612
- SHA512 4ddf3578dcadfb33e288733a072ff9ad31ebdf34ccd20b5739c8df0d6e351e9aa7f6929bacb1ad381f483b8b1d82a4a28879f2d5c9cf2f615c00f5d1e236fcb0
- SSDEEP 393216:0qEKUxqn7KbntdG8v4M5sR1Fmnj/NTWxX6Jx2NkPs+:0GUxg7QjGZM2LcnjVQ6Jx2C3
- TLSH T1B2170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-17_370e6b288038da411dcedb5c39fc2b9e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_370e6b288038da411dcedb5c39fc2b9e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-17_370e6b288038da411dcedb5c39fc2b9e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 17.7MB
- SHA256 e8abdadc4852e7a2cb8b565ab67cb41a89914cecc2fe5d05c02d9b4b9bf4d5a2
- MD5 370e6b288038da411dcedb5c39fc2b9e
- SHA1 9555de9c96b26243919ba016ff648043bcbb2612
- SHA512 4ddf3578dcadfb33e288733a072ff9ad31ebdf34ccd20b5739c8df0d6e351e9aa7f6929bacb1ad381f483b8b1d82a4a28879f2d5c9cf2f615c00f5d1e236fcb0
- SSDEEP 393216:0qEKUxqn7KbntdG8v4M5sR1Fmnj/NTWxX6Jx2NkPs+:0GUxg7QjGZM2LcnjVQ6Jx2C3
- TLSH T1B2170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE