General
- Target 2026-08-10_01613e0a18a6487a3b8be13f7bf543d7_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 13.0MB
- Sample260810-t41twataka
- SHA256 cfe813da32f7ffc70bb9f13da46ee69c778b55301e743d5efb7942b53083241e
- MD5 01613e0a18a6487a3b8be13f7bf543d7
- SHA1 103c9799f7c57d5813212370e4b58c766607797d
- SHA512 de47df8ccb003372580c5713190af9ad24bece05879ddb6d57ce568ab1bc751811ca640e9133e7af67e85c21eb8f4837b75fb8529688f053e79d706aeb465851
- SSDEEP 196608:78bnLDYdppqMP0vi/Mn/R15fmmpLAHgWKLbqw5LTK+ZrXcBstTdvn5ZjBxcO4Tj:QbnId78v4Mn/R1Ft+XExThs2bJk2
- TLSH T1C3D6F126AAA00FA5F433813407B6C566D63A7C3A172087CF7358F65A2F736D1583E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-10_01613e0a18a6487a3b8be13f7bf543d7_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_01613e0a18a6487a3b8be13f7bf543d7_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_01613e0a18a6487a3b8be13f7bf543d7_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 13.0MB
- SHA256 cfe813da32f7ffc70bb9f13da46ee69c778b55301e743d5efb7942b53083241e
- MD5 01613e0a18a6487a3b8be13f7bf543d7
- SHA1 103c9799f7c57d5813212370e4b58c766607797d
- SHA512 de47df8ccb003372580c5713190af9ad24bece05879ddb6d57ce568ab1bc751811ca640e9133e7af67e85c21eb8f4837b75fb8529688f053e79d706aeb465851
- SSDEEP 196608:78bnLDYdppqMP0vi/Mn/R15fmmpLAHgWKLbqw5LTK+ZrXcBstTdvn5ZjBxcO4Tj:QbnId78v4Mn/R1Ft+XExThs2bJk2
- TLSH T1C3D6F126AAA00FA5F433813407B6C566D63A7C3A172087CF7358F65A2F736D1583E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE