General
- Target 2026-07-20_80cecf0cca3fcfa4cf542c81b0cdee19_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbot_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_loki-bot_luca-stealer_njrat_ramnit_remcos_smoke-loader_stealc_vidar_wannacry
- Size 36.1MB
- Sample260720-xzvnvacy3m
- SHA256 78e398353b95b4fa73c309fe1a32be98535cd87ab3e06fed1ae66d872ffa95df
- MD5 80cecf0cca3fcfa4cf542c81b0cdee19
- SHA1 69065de7ef71a9f9e32d83893a8ef5b88c95aed3
- SHA512 65d4ea438135ffbe83c7a9225df8c5b01b60629f5c8260f4c716626ebae96b5c316f461eca43287e7d4ed7e1abf55f6535e82055bab8d0a9ceb69d956a7dd0f2
- SSDEEP 786432:SIE6LJ/MIqkR+g/ttUxgvuv7ZM/Lb6mmY6JL2m:SIE6LJEIL0AttG1v7uLbVmDd2m
- TLSH T13787E0A69AB002E1F97A8434CE52A626D9317C150B608BCF369CB65F1F737F2583E345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-20_80cecf0cca3fcfa4cf542c81b0cdee19_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbo.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_80cecf0cca3fcfa4cf542c81b0cdee19_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbo.exe
Resource
win11ltsc2024-20260710-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_80cecf0cca3fcfa4cf542c81b0cdee19_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbot_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_loki-bot_luca-stealer_njrat_ramnit_remcos_smoke-loader_stealc_vidar_wannacry
- Size 36.1MB
- SHA256 78e398353b95b4fa73c309fe1a32be98535cd87ab3e06fed1ae66d872ffa95df
- MD5 80cecf0cca3fcfa4cf542c81b0cdee19
- SHA1 69065de7ef71a9f9e32d83893a8ef5b88c95aed3
- SHA512 65d4ea438135ffbe83c7a9225df8c5b01b60629f5c8260f4c716626ebae96b5c316f461eca43287e7d4ed7e1abf55f6535e82055bab8d0a9ceb69d956a7dd0f2
- SSDEEP 786432:SIE6LJ/MIqkR+g/ttUxgvuv7ZM/Lb6mmY6JL2m:SIE6LJEIL0AttG1v7uLbVmDd2m
- TLSH T13787E0A69AB002E1F97A8434CE52A626D9317C150B608BCF369CB65F1F737F2583E345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing possible sandbox analysis VM usernames
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE