General
- Target 2026-08-08_10344edb91022f3b4a38b4c7b4a2e044_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260808-m2cwpsdr7w
- SHA256 f86b3183efbc27c8551dcebd549c79a2cf90d0dc48ae9a1acfe89082b442588f
- MD5 10344edb91022f3b4a38b4c7b4a2e044
- SHA1 4a2dbbbfbb653c89395920c09fcb2c0c2288e02f
- SHA512 6ed78777e21ea8b83a4946bf1f16a24a0344f67d5c345094219668739d0e4794be596fe87f3d79e9d4fbee8065c8fd383b84b951e4a43e9c444c2f2ad44edcbe
- SSDEEP 196608:EJlv2/1n/R15fmmpiLHgWKL6qW4LBK+ZrscB3tTd0n5Zj1xcO40jV2VNeA9J1mPH:EXvk1n/R1FtOXEdBhBrW1p2NjJsP
- TLSH T19FD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-08_10344edb91022f3b4a38b4c7b4a2e044_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_10344edb91022f3b4a38b4c7b4a2e044_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-08_10344edb91022f3b4a38b4c7b4a2e044_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 f86b3183efbc27c8551dcebd549c79a2cf90d0dc48ae9a1acfe89082b442588f
- MD5 10344edb91022f3b4a38b4c7b4a2e044
- SHA1 4a2dbbbfbb653c89395920c09fcb2c0c2288e02f
- SHA512 6ed78777e21ea8b83a4946bf1f16a24a0344f67d5c345094219668739d0e4794be596fe87f3d79e9d4fbee8065c8fd383b84b951e4a43e9c444c2f2ad44edcbe
- SSDEEP 196608:EJlv2/1n/R15fmmpiLHgWKL6qW4LBK+ZrscB3tTd0n5Zj1xcO40jV2VNeA9J1mPH:EXvk1n/R1FtOXEdBhBrW1p2NjJsP
- TLSH T19FD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE