General
- Target 2026-07-23_a6631d567d1629696cb6751db0f08e1f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260723-vztenstdmf
- SHA256 51863f0492b2b864c68c32ffd2c106afcd97b1aac10b13d3f146d343b43fc5f7
- MD5 a6631d567d1629696cb6751db0f08e1f
- SHA1 912ddf656b1d4f96753651c0a0609d016c901ff2
- SHA512 c233369be70542b6ef0bbad393d5fc8e76e92c6c1f4ea46072ae230af17dd644b0d2287860e9d021343e2e9e9f90217ee8e82ef1ff687f5b39f3f43b9e05ef82
- SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKL6qw5LTK+ZmsSBQtTdgn5njBxcO4C8V2VNgbPJ1m+z:ENf4Mn/R1FtcXEOTMvS6XG2NwJs+
- TLSH T176D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-23_a6631d567d1629696cb6751db0f08e1f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_a6631d567d1629696cb6751db0f08e1f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_a6631d567d1629696cb6751db0f08e1f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 51863f0492b2b864c68c32ffd2c106afcd97b1aac10b13d3f146d343b43fc5f7
- MD5 a6631d567d1629696cb6751db0f08e1f
- SHA1 912ddf656b1d4f96753651c0a0609d016c901ff2
- SHA512 c233369be70542b6ef0bbad393d5fc8e76e92c6c1f4ea46072ae230af17dd644b0d2287860e9d021343e2e9e9f90217ee8e82ef1ff687f5b39f3f43b9e05ef82
- SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKL6qw5LTK+ZmsSBQtTdgn5njBxcO4C8V2VNgbPJ1m+z:ENf4Mn/R1FtcXEOTMvS6XG2NwJs+
- TLSH T176D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE