General
- Target 2026-07-18_eace06e72d9c0d61a383f111c14200b2_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260718-gm5qaac16y
- SHA256 79e09e9d7aae015fcf4efaddcc93b88296a17e8197b5e3ff9610035c78a8f185
- MD5 eace06e72d9c0d61a383f111c14200b2
- SHA1 f3fa00d2266110ccaede29bd4148052d34aa4905
- SHA512 1d9d33affb49bc380dc46ae6b492b5a50ee778fe6096380901014eabee0e0bf71cb9c29fe0a18cb038eefd259bf5032344586a6f85efc21422831d032e28d5e4
- SSDEEP 196608:EJ0Pi/Mn/R15fmmIiDHgWKLuqw5MTK+ZrshB3tTdgnIZjBxcO4TjV2bNfbvJ1m+H:EqP4Mn/R1FcGXENTh8rbJk0NjJs+
- TLSH T15CD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-18_eace06e72d9c0d61a383f111c14200b2_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_eace06e72d9c0d61a383f111c14200b2_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-18_eace06e72d9c0d61a383f111c14200b2_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 79e09e9d7aae015fcf4efaddcc93b88296a17e8197b5e3ff9610035c78a8f185
- MD5 eace06e72d9c0d61a383f111c14200b2
- SHA1 f3fa00d2266110ccaede29bd4148052d34aa4905
- SHA512 1d9d33affb49bc380dc46ae6b492b5a50ee778fe6096380901014eabee0e0bf71cb9c29fe0a18cb038eefd259bf5032344586a6f85efc21422831d032e28d5e4
- SSDEEP 196608:EJ0Pi/Mn/R15fmmIiDHgWKLuqw5MTK+ZrshB3tTdgnIZjBxcO4TjV2bNfbvJ1m+H:EqP4Mn/R1FcGXENTh8rbJk0NjJs+
- TLSH T15CD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE