General
- Target 2026-07-21_397469078b4e79185fb0175b7132cba6_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260721-byardsbv9n
- SHA256 1964381861220c0067c4212d22bf2b53afc1dd557c4cfdd95b3e90008d67e6cb
- MD5 397469078b4e79185fb0175b7132cba6
- SHA1 d9753092fadddf86222d4d75d4b5c87cbe915981
- SHA512 ba98aabd169d873cc1705ac2e33ba1776bcad75d27be4900f27eec6ba9d7abf8414bc8d1ea51f92623f8f9d340418c535db6aea2f93bd4246e78f57c2b5812ad
- SSDEEP 196608:EP/vi/Mn/R1wfmmBLDHg0KLjqw5LQx+ZDscilvtdlTJZjBxcO4TzV2VNKbPJ1msH:Env4Mn/R1qlntEpQqBUdJ02NuJss
- TLSH T1E6D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-21_397469078b4e79185fb0175b7132cba6_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-21_397469078b4e79185fb0175b7132cba6_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-21_397469078b4e79185fb0175b7132cba6_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 1964381861220c0067c4212d22bf2b53afc1dd557c4cfdd95b3e90008d67e6cb
- MD5 397469078b4e79185fb0175b7132cba6
- SHA1 d9753092fadddf86222d4d75d4b5c87cbe915981
- SHA512 ba98aabd169d873cc1705ac2e33ba1776bcad75d27be4900f27eec6ba9d7abf8414bc8d1ea51f92623f8f9d340418c535db6aea2f93bd4246e78f57c2b5812ad
- SSDEEP 196608:EP/vi/Mn/R1wfmmBLDHg0KLjqw5LQx+ZDscilvtdlTJZjBxcO4TzV2VNKbPJ1msH:Env4Mn/R1qlntEpQqBUdJ02NuJss
- TLSH T1E6D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE