General
- Target 2026-07-20_2114f61b31a54ee5bb43b61a2331237b_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbot_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_loki-bot_luca-stealer_njrat_ramnit_remcos_smoke-loader_stealc_vidar_wannacry
- Size 37.7MB
- Sample260720-yfec7ae16w
- SHA256 f992a125bbfe02cc9c1d83a2263b30954ea1dd7ca48d1b07850762aea915de4a
- MD5 2114f61b31a54ee5bb43b61a2331237b
- SHA1 4aa93704e17fa69cee71a96b46000cd6d25b8345
- SHA512 eb3d2d39017ed5084af0c1328314f15368f1b084f32ff32fbe48524f23e627787fbecb31374653fe1ece9ae2e7e121a584001f9ab179bbbfc7a41d2fc0e7c794
- SSDEEP 786432:SIE6LJ/MNqkR+g/ttUxgvuv7ZM/Lb6mmY6JL2E+:SIE6LJENL0AttG1v7uLbVmDd2E+
- TLSH T15C87E0A6997002E1F97A8434CE52A626D9317C190B608BCF369CB65F2F737F2583E345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-20_2114f61b31a54ee5bb43b61a2331237b_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbo.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_2114f61b31a54ee5bb43b61a2331237b_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbo.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_2114f61b31a54ee5bb43b61a2331237b_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbot_darkgate_elex_gcleaner_glassworm_hawkeye_icedid_loki-bot_luca-stealer_njrat_ramnit_remcos_smoke-loader_stealc_vidar_wannacry
- Size 37.7MB
- SHA256 f992a125bbfe02cc9c1d83a2263b30954ea1dd7ca48d1b07850762aea915de4a
- MD5 2114f61b31a54ee5bb43b61a2331237b
- SHA1 4aa93704e17fa69cee71a96b46000cd6d25b8345
- SHA512 eb3d2d39017ed5084af0c1328314f15368f1b084f32ff32fbe48524f23e627787fbecb31374653fe1ece9ae2e7e121a584001f9ab179bbbfc7a41d2fc0e7c794
- SSDEEP 786432:SIE6LJ/MNqkR+g/ttUxgvuv7ZM/Lb6mmY6JL2E+:SIE6LJENL0AttG1v7uLbVmDd2E+
- TLSH T15C87E0A6997002E1F97A8434CE52A626D9317C190B608BCF369CB65F2F737F2583E345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing possible sandbox analysis VM usernames
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE