General
- Target 2026-07-27_d2f8a84fc0b52d89ceff8729156415bc_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 15.7MB
- Sample260727-yjpy4adj5y
- SHA256 c16ccfe12530b703aa1a3e1f3642db935540e67f9b89ebd2830c3622e5a27c51
- MD5 d2f8a84fc0b52d89ceff8729156415bc
- SHA1 de4f8dad116d38dd512adcfb651c36a4a9d66ddd
- SHA512 d1d3fe3d5f183c14d87041fb482c937bfa4dbf1b68d9230938d382637923a29d98b8ae5a7c859411ce13e8e8786228c9974167c4db890d07ce00a3a5cb4878b0
- SSDEEP 393216:pbn7d78v4Mn/R1qt6XElTht96Jk49Kms+:9p7ZM/Li6X6d6Jk40O
- TLSH T104F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-27_d2f8a84fc0b52d89ceff8729156415bc_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_d2f8a84fc0b52d89ceff8729156415bc_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-27_d2f8a84fc0b52d89ceff8729156415bc_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 15.7MB
- SHA256 c16ccfe12530b703aa1a3e1f3642db935540e67f9b89ebd2830c3622e5a27c51
- MD5 d2f8a84fc0b52d89ceff8729156415bc
- SHA1 de4f8dad116d38dd512adcfb651c36a4a9d66ddd
- SHA512 d1d3fe3d5f183c14d87041fb482c937bfa4dbf1b68d9230938d382637923a29d98b8ae5a7c859411ce13e8e8786228c9974167c4db890d07ce00a3a5cb4878b0
- SSDEEP 393216:pbn7d78v4Mn/R1qt6XElTht96Jk49Kms+:9p7ZM/Li6X6d6Jk40O
- TLSH T104F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE