General
- Target 2026-07-28_bca6fe1526cc041edaf7ce7b50663137_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 17.7MB
- Sample260729-asp4fsssey
- SHA256 cf6171ed04fb491b5b466fbb9d4f44b359a38de868c0a0ca0525174b83565556
- MD5 bca6fe1526cc041edaf7ce7b50663137
- SHA1 0b3f139386c83e26c6a7368fd42325ecb56366c9
- SHA512 949fe947fd853aa8afd0dde8301cc2299ad0f7c8ee28c2801000537e2c20c1b2445440e797773276fc6b89456e314aa421e6dc7fb49a50b4eb88361f666b2d4f
- SSDEEP 393216:RJEKUxqnvQbntd78v4Mn/R1Ft+XEOThsc64kMNyJsv:RtUxgvOj7ZM/Lb+XFN64kM0w
- TLSH T1F2170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-28_bca6fe1526cc041edaf7ce7b50663137_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_bca6fe1526cc041edaf7ce7b50663137_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-28_bca6fe1526cc041edaf7ce7b50663137_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 17.7MB
- SHA256 cf6171ed04fb491b5b466fbb9d4f44b359a38de868c0a0ca0525174b83565556
- MD5 bca6fe1526cc041edaf7ce7b50663137
- SHA1 0b3f139386c83e26c6a7368fd42325ecb56366c9
- SHA512 949fe947fd853aa8afd0dde8301cc2299ad0f7c8ee28c2801000537e2c20c1b2445440e797773276fc6b89456e314aa421e6dc7fb49a50b4eb88361f666b2d4f
- SSDEEP 393216:RJEKUxqnvQbntd78v4Mn/R1Ft+XEOThsc64kMNyJsv:RtUxgvOj7ZM/Lb+XFN64kM0w
- TLSH T1F2170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE