General
- Target 2026-07-18_775fd5b0a75c08b33c1b9427a4cf3581_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260718-v932vscs71
- SHA256 890cf9e8b86c78ec22af8b3974259509babfef309da84dfdc71148ae4e75b733
- MD5 775fd5b0a75c08b33c1b9427a4cf3581
- SHA1 ce8c322ddb6fafbf25011074cf191b634dd550da
- SHA512 cab339d41c6743b021eae5ce1d639b2dcca45467a351030e277bbc68ccb4462bdf1db06a8a62d23da388b3b37268ebaed15f152953b8d27c6da931d2d0f65259
- SSDEEP 196608:EPAvi/Mn/R15fmmpiAHgWKL4qwBL9K+Z1kzBTtTdgTYZjBxcO4TjV2VNrVBS1G0H:EYv4Mn/R1Ft3XEU9ninnJk2N7SM0
- TLSH T11DD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-18_775fd5b0a75c08b33c1b9427a4cf3581_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_775fd5b0a75c08b33c1b9427a4cf3581_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-18_775fd5b0a75c08b33c1b9427a4cf3581_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 890cf9e8b86c78ec22af8b3974259509babfef309da84dfdc71148ae4e75b733
- MD5 775fd5b0a75c08b33c1b9427a4cf3581
- SHA1 ce8c322ddb6fafbf25011074cf191b634dd550da
- SHA512 cab339d41c6743b021eae5ce1d639b2dcca45467a351030e277bbc68ccb4462bdf1db06a8a62d23da388b3b37268ebaed15f152953b8d27c6da931d2d0f65259
- SSDEEP 196608:EPAvi/Mn/R15fmmpiAHgWKL4qwBL9K+Z1kzBTtTdgTYZjBxcO4TjV2VNrVBS1G0H:EYv4Mn/R1Ft3XEU9ninnJk2N7SM0
- TLSH T11DD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE