General
- Target 2026-08-03_34acb8573add0e31e444e6b4aa1e4d75_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 13.6MB
- Sample260804-ppjvlazhqg
- SHA256 cd6c17db92c256b1dabb1e39bb3775031dd21d81a26ba92ffa34a21252b51fcf
- MD5 34acb8573add0e31e444e6b4aa1e4d75
- SHA1 ad6a28e8fa6427fc47a2e08e392bea8198adf2dc
- SHA512 f5723de344d697b8a3c1dae763c92b34bc25fc6054660551f6688e00ba30fb0b453b5cb519b72bc0a57f0f1bf4dd5f368b0d12495eee7753d762beb25705fced
- SSDEEP 196608:7ibnLE9tppqMP0Gi/Mn/R11fmmpLDHIWKL6qwSLTK+ZIXcB3tTdXn5ZjBxcO47TP:WbnCt78G4Mn/R1Ztn/E9TusrfJs2Ne
- TLSH T17EE6F226AAA00FA5F433813407B6C566D63A7C3A572087CF7358F65A2F732D1583E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-03_34acb8573add0e31e444e6b4aa1e4d75_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_34acb8573add0e31e444e6b4aa1e4d75_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_34acb8573add0e31e444e6b4aa1e4d75_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 13.6MB
- SHA256 cd6c17db92c256b1dabb1e39bb3775031dd21d81a26ba92ffa34a21252b51fcf
- MD5 34acb8573add0e31e444e6b4aa1e4d75
- SHA1 ad6a28e8fa6427fc47a2e08e392bea8198adf2dc
- SHA512 f5723de344d697b8a3c1dae763c92b34bc25fc6054660551f6688e00ba30fb0b453b5cb519b72bc0a57f0f1bf4dd5f368b0d12495eee7753d762beb25705fced
- SSDEEP 196608:7ibnLE9tppqMP0Gi/Mn/R11fmmpLDHIWKL6qwSLTK+ZIXcB3tTdXn5ZjBxcO47TP:WbnCt78G4Mn/R1Ztn/E9TusrfJs2Ne
- TLSH T17EE6F226AAA00FA5F433813407B6C566D63A7C3A572087CF7358F65A2F732D1583E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE