General
- Target 2026-07-20_534ce136c9e6c6a35026606b692168b3_agent-tesla_akira_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_loki-bot_njrat_remcos_stealc_vidar_wannacry
- Size 28.9MB
- Sample260720-x8cjmac18q
- SHA256 2f07aab79d52846436d1504a25786dfb0958869b021aaadfb549252ff4485820
- MD5 534ce136c9e6c6a35026606b692168b3
- SHA1 a107771635c98beca61c51aa06b0e14965eeb177
- SHA512 220e86a44626496efd7e30f39acdda441632a6f44751ad2a6f76ea74d1b369fc8045117ab0c84aab374788b72e0cff4df122fda482cfb672ed47275312bbbc64
- SSDEEP 393216:SIEVQKu/v1LLJbfrqbTZs396XJsQII3kGYt+cNSG/lVmOSOJEKUxqnvwbnRd78vD:SIE6LJ/MQqkR+g/ttUxgvuv7ZM/LbJ
- TLSH T1B267D0A69A7002E1FE7A8834CE52A526D9317C150F609BCF3A9CB55F1B736F2583E344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-20_534ce136c9e6c6a35026606b692168b3_agent-tesla_akira_cobalt-strike_coinminer_darkgate_elex_.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_534ce136c9e6c6a35026606b692168b3_agent-tesla_akira_cobalt-strike_coinminer_darkgate_elex_.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_534ce136c9e6c6a35026606b692168b3_agent-tesla_akira_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_loki-bot_njrat_remcos_stealc_vidar_wannacry
- Size 28.9MB
- SHA256 2f07aab79d52846436d1504a25786dfb0958869b021aaadfb549252ff4485820
- MD5 534ce136c9e6c6a35026606b692168b3
- SHA1 a107771635c98beca61c51aa06b0e14965eeb177
- SHA512 220e86a44626496efd7e30f39acdda441632a6f44751ad2a6f76ea74d1b369fc8045117ab0c84aab374788b72e0cff4df122fda482cfb672ed47275312bbbc64
- SSDEEP 393216:SIEVQKu/v1LLJbfrqbTZs396XJsQII3kGYt+cNSG/lVmOSOJEKUxqnvwbnRd78vD:SIE6LJ/MQqkR+g/ttUxgvuv7ZM/LbJ
- TLSH T1B267D0A69A7002E1FE7A8834CE52A526D9317C150F609BCF3A9CB55F1B736F2583E344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing possible sandbox analysis VM usernames
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE