General
- Target 2026-07-30_2f5243c6d33599b5af9ef83dccef6b37_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260730-q4256aae26
- SHA256 5ef3e0c89f7bd26f7ceab4645e81f3dc7a531ac0c774d3f3df57ba11fe219a25
- MD5 2f5243c6d33599b5af9ef83dccef6b37
- SHA1 a0d0bb9129019858d428c654352b3724bb5ee3a5
- SHA512 f0ae3e7a95d986a38b9c25b828ce0281961380fffb086e872a377c7019c899cd60b45e6937eed730489a141ddea62d6740d4cdb5b8e73f6d179f7f4bada80898
- SSDEEP 196608:EP0vi/Mn/R15fmmpiyHgWKL6qw6LTK+Z/s4B3tTdgY5ZjBxcO4TjV2VNwbPS1m+H:E8v4Mn/R1Ft1XEdTVlrFJk2NgSs+
- TLSH T143D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-30_2f5243c6d33599b5af9ef83dccef6b37_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_2f5243c6d33599b5af9ef83dccef6b37_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-30_2f5243c6d33599b5af9ef83dccef6b37_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 5ef3e0c89f7bd26f7ceab4645e81f3dc7a531ac0c774d3f3df57ba11fe219a25
- MD5 2f5243c6d33599b5af9ef83dccef6b37
- SHA1 a0d0bb9129019858d428c654352b3724bb5ee3a5
- SHA512 f0ae3e7a95d986a38b9c25b828ce0281961380fffb086e872a377c7019c899cd60b45e6937eed730489a141ddea62d6740d4cdb5b8e73f6d179f7f4bada80898
- SSDEEP 196608:EP0vi/Mn/R15fmmpiyHgWKL6qw6LTK+Z/s4B3tTdgY5ZjBxcO4TjV2VNwbPS1m+H:E8v4Mn/R1Ft1XEdTVlrFJk2NgSs+
- TLSH T143D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE