General
- Target 2026-07-29_b172b8a3e475cf91aaac0640c8db4bb7_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 11.3MB
- Sample260729-vq3a8a1scs
- SHA256 024fb9da73e87b960f29d1589075e34996002788e0453303e2e13f7bce7e35aa
- MD5 b172b8a3e475cf91aaac0640c8db4bb7
- SHA1 669ea4f7580857d6fd40699809241d00af796217
- SHA512 29bb7f95014199aebb357f097779782cf39018a0ed2130e797ab5a10c6101c29b16962f6c43efb5eb1b5777c18007e64750013b42aefe831cfd39d34bb949d94
- SSDEEP 196608:Ea0vi/Mn/R15fmmBLDHgWKL6qw5LTH+ZrscB3ttdQn5ZjBxcO4ujV2VNg:E3v4Mn/R1FlnXEOTUBVqJH2N
- TLSH T165C6F125EAA00EF1F473913446A2D666D2757C3A172087CF2798EA0E3F336E1593E716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-29_b172b8a3e475cf91aaac0640c8db4bb7_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_b172b8a3e475cf91aaac0640c8db4bb7_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-29_b172b8a3e475cf91aaac0640c8db4bb7_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 11.3MB
- SHA256 024fb9da73e87b960f29d1589075e34996002788e0453303e2e13f7bce7e35aa
- MD5 b172b8a3e475cf91aaac0640c8db4bb7
- SHA1 669ea4f7580857d6fd40699809241d00af796217
- SHA512 29bb7f95014199aebb357f097779782cf39018a0ed2130e797ab5a10c6101c29b16962f6c43efb5eb1b5777c18007e64750013b42aefe831cfd39d34bb949d94
- SSDEEP 196608:Ea0vi/Mn/R15fmmBLDHgWKL6qw5LTH+ZrscB3ttdQn5ZjBxcO4ujV2VNg:E3v4Mn/R1FlnXEOTUBVqJH2N
- TLSH T165C6F125EAA00EF1F473913446A2D666D2757C3A172087CF2798EA0E3F336E1593E716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE