General
- Target 2026-07-21_42352d86612470ee85683af91178c244_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260721-bw6faabv6q
- SHA256 11762ec60f17e40ff7167690c3e5c1a2d4ef26b5286314a14f693c2c603d4ef0
- MD5 42352d86612470ee85683af91178c244
- SHA1 05a0d3631ebd577ac150e58abff4eecc732c355a
- SHA512 575721f037fdc1ebe85df7b4c5bb986153d5c6a28c40d25af1a3976753ed01a745a4b88a3a29e0c38cd7469626b278361560cb374f8947c9e0047bde1fc2d4b6
- SSDEEP 196608:EP0vi/Mn/R1/fmmtiDHgWKL6Sw5LTF+Z1u4BLtNdg95ZjBxcO4TjV2VNIbLS1m+H:E8v4Mn/R1H5GXEmTYrJoJk2NMSs+
- TLSH T121D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-21_42352d86612470ee85683af91178c244_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-21_42352d86612470ee85683af91178c244_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-21_42352d86612470ee85683af91178c244_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 11762ec60f17e40ff7167690c3e5c1a2d4ef26b5286314a14f693c2c603d4ef0
- MD5 42352d86612470ee85683af91178c244
- SHA1 05a0d3631ebd577ac150e58abff4eecc732c355a
- SHA512 575721f037fdc1ebe85df7b4c5bb986153d5c6a28c40d25af1a3976753ed01a745a4b88a3a29e0c38cd7469626b278361560cb374f8947c9e0047bde1fc2d4b6
- SSDEEP 196608:EP0vi/Mn/R1/fmmtiDHgWKL6Sw5LTF+Z1u4BLtNdg95ZjBxcO4TjV2VNIbLS1m+H:E8v4Mn/R1H5GXEmTYrJoJk2NMSs+
- TLSH T121D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE