General
- Target 2026-08-02_141674c0aeb5c6591d9e257252327142_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 13.0MB
- Sample260802-d5qgjacp3s
- SHA256 d06bae1a0815d1b2e0e349fd4d09dd4b0460935dd9c510a807610d811499d801
- MD5 141674c0aeb5c6591d9e257252327142
- SHA1 4a5670c5fcf39caf3f7e73b960f2ecc3e52f4a47
- SHA512 e3e4a6648e29ec438c218d1ef880ee5396796938f0c525f9aaa9b471d0b10554d5256291dd0248bf326cb4bf54f0305221700876c085eea89b07b3beb2da22a5
- SSDEEP 196608:7NbnLD5dppqMP0vi/Mn/R15fmmpBAHgWKLbqw5LTK+ZKX/BstTdgn5ZjBxcO4TjN:pbnJd78v4Mn/R1FtsXExTQv26Jk2M
- TLSH T10AD6F126AAA00FA5F433813407B6C566D63A7C3A172087CF7358F65A2F736D1583E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-02_141674c0aeb5c6591d9e257252327142_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_141674c0aeb5c6591d9e257252327142_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_141674c0aeb5c6591d9e257252327142_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 13.0MB
- SHA256 d06bae1a0815d1b2e0e349fd4d09dd4b0460935dd9c510a807610d811499d801
- MD5 141674c0aeb5c6591d9e257252327142
- SHA1 4a5670c5fcf39caf3f7e73b960f2ecc3e52f4a47
- SHA512 e3e4a6648e29ec438c218d1ef880ee5396796938f0c525f9aaa9b471d0b10554d5256291dd0248bf326cb4bf54f0305221700876c085eea89b07b3beb2da22a5
- SSDEEP 196608:7NbnLD5dppqMP0vi/Mn/R15fmmpBAHgWKLbqw5LTK+ZKX/BstTdgn5ZjBxcO4TjN:pbnJd78v4Mn/R1FtsXExTQv26Jk2M
- TLSH T10AD6F126AAA00FA5F433813407B6C566D63A7C3A172087CF7358F65A2F736D1583E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE