General
- Target 2026-08-01_fab3ced00ec956165b3b2e19e037b930_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260801-cth3mscb75
- SHA256 0b733b84158a7b913fd20928e44c590bbdeae7b30113cd0ceade1cd4b634e9d4
- MD5 fab3ced00ec956165b3b2e19e037b930
- SHA1 3c7d293f75447c55528e0ee25f886680d0df1556
- SHA512 3e488dc105452e08fa18e35fdd1948d0a89d8a3c0e462b52dbccc9a49471d40005710f179efa9074a01da039b86e28ee3c30d405fccf2a3faac1df92eb6a6f1e
- SSDEEP 196608:EP0vi/Mn/R15fYm+LkHgWKt/qwZaT++ZIXLB3tcdRn5ZjBxcO4tbV2VNgLPJ1m+H:E8v4Mn/R1FIqXiATC701JG2NgJs+
- TLSH T154D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-01_fab3ced00ec956165b3b2e19e037b930_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_fab3ced00ec956165b3b2e19e037b930_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_fab3ced00ec956165b3b2e19e037b930_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 0b733b84158a7b913fd20928e44c590bbdeae7b30113cd0ceade1cd4b634e9d4
- MD5 fab3ced00ec956165b3b2e19e037b930
- SHA1 3c7d293f75447c55528e0ee25f886680d0df1556
- SHA512 3e488dc105452e08fa18e35fdd1948d0a89d8a3c0e462b52dbccc9a49471d40005710f179efa9074a01da039b86e28ee3c30d405fccf2a3faac1df92eb6a6f1e
- SSDEEP 196608:EP0vi/Mn/R15fYm+LkHgWKt/qwZaT++ZIXLB3tcdRn5ZjBxcO4tbV2VNgLPJ1m+H:E8v4Mn/R1FIqXiATC701JG2NgJs+
- TLSH T154D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE