General
- Target 2026-08-04_9745a3c73e6d09d04badb5bc137a3270_agent-tesla_cobalt-strike_coinminer_cryptbot_darkgate_elex_gcleaner_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_stealc_vidar
- Size 23.1MB
- Sample260804-r8vsbace57
- SHA256 04c3196bc38d7b33b79d0b0e3ee0d5ecc5c2432f48d6da7f837d5de170957bb9
- MD5 9745a3c73e6d09d04badb5bc137a3270
- SHA1 15c95d424f6aad46540c823d1077f95787d53e48
- SHA512 3833cd96bead0af5f00726ef96593bf3a4d010ac4ad867683bd5d5baa369210ec4955cc354cf6b8749c11287c8d9d624daabc91677433fc1b3fe8b38a17fb5c2
- SSDEEP 393216:bJsQXI3mGGt+eNSG/lVC3S5JEKUxqnvQbn7d71v4Mn/R1F/nXEOThB:b/qm/+qCatUxgvOp7OM/LBnXF
- TLSH T16237E0B68C705691FE3A4834CE61A964CD357C291FA08BCF2958B18F67736F3543E289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-04_9745a3c73e6d09d04badb5bc137a3270_agent-tesla_cobalt-strike_coinminer_cryptbot_darkgate_el.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_9745a3c73e6d09d04badb5bc137a3270_agent-tesla_cobalt-strike_coinminer_cryptbot_darkgate_el.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_9745a3c73e6d09d04badb5bc137a3270_agent-tesla_cobalt-strike_coinminer_cryptbot_darkgate_elex_gcleaner_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_stealc_vidar
- Size 23.1MB
- SHA256 04c3196bc38d7b33b79d0b0e3ee0d5ecc5c2432f48d6da7f837d5de170957bb9
- MD5 9745a3c73e6d09d04badb5bc137a3270
- SHA1 15c95d424f6aad46540c823d1077f95787d53e48
- SHA512 3833cd96bead0af5f00726ef96593bf3a4d010ac4ad867683bd5d5baa369210ec4955cc354cf6b8749c11287c8d9d624daabc91677433fc1b3fe8b38a17fb5c2
- SSDEEP 393216:bJsQXI3mGGt+eNSG/lVC3S5JEKUxqnvQbn7d71v4Mn/R1F/nXEOThB:b/qm/+qCatUxgvOp7OM/LBnXF
- TLSH T16237E0B68C705691FE3A4834CE61A964CD357C291FA08BCF2958B18F67736F3543E289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE