General
- Target 2026-08-08_4419d196f853c393c1e98126467688a4_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260808-mzebradr4z
- SHA256 d5ef8e159862e828ff5d4075fe8e4e85f2261066b79966cce2477bda68cf4ac8
- MD5 4419d196f853c393c1e98126467688a4
- SHA1 cedbc3cd9ee5859276824e9ebdf6f655ce56de5b
- SHA512 959d77fa9f4b0e2a5b9b3cbf92eb2cb2330350857f5bc15f4f537abd9cfa717533efaf9a360c62751203bc3b1cff8e1aa95e7f99dac27c057a0c41d13148cb83
- SSDEEP 196608:EJlvi/1n/R15fmmpiLHgWKL6qWTLTK+ZGsyB3tsdgn5ZjBxcO4gjV2VNwWNJ1mHH:EXv41n/R1FtOXEWTkX06J92NLJsH
- TLSH T1C5D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-08_4419d196f853c393c1e98126467688a4_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_4419d196f853c393c1e98126467688a4_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-08_4419d196f853c393c1e98126467688a4_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 d5ef8e159862e828ff5d4075fe8e4e85f2261066b79966cce2477bda68cf4ac8
- MD5 4419d196f853c393c1e98126467688a4
- SHA1 cedbc3cd9ee5859276824e9ebdf6f655ce56de5b
- SHA512 959d77fa9f4b0e2a5b9b3cbf92eb2cb2330350857f5bc15f4f537abd9cfa717533efaf9a360c62751203bc3b1cff8e1aa95e7f99dac27c057a0c41d13148cb83
- SSDEEP 196608:EJlvi/1n/R15fmmpiLHgWKL6qWTLTK+ZGsyB3tsdgn5ZjBxcO4gjV2VNwWNJ1mHH:EXv41n/R1FtOXEWTkX06J92NLJsH
- TLSH T1C5D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE