General
- Target 2026-08-11_04e7065461fb2f84001cad1f71a0638d_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 20.5MB
- Sample260811-ej4mpsfn8t
- SHA256 5bbe9e72f98d2b6df02811ba41aed4fbbf830f27e45989c5ccb3543bc63271b9
- MD5 04e7065461fb2f84001cad1f71a0638d
- SHA1 d6b5b8e2c8c86eba156dbd84542ef885c73d60f8
- SHA512 45b4f4f9e893fc0bafb68365b6efcefa5fd1de98f46b1df3d99b0b96c97756bfe02524d7892c127e64c224e90a709e44eb3c092ed91a1f4575ba75d5c4eaaaad
- SSDEEP 393216:/+S+JEKUxqnvQbntd78v4Mn/R1Ft+XEOThs26Jk2NPJsv:m9tUxgvOj7ZM/Lb+XFH6Jk25w
- TLSH T1C827D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-11_04e7065461fb2f84001cad1f71a0638d_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_04e7065461fb2f84001cad1f71a0638d_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-11_04e7065461fb2f84001cad1f71a0638d_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 20.5MB
- SHA256 5bbe9e72f98d2b6df02811ba41aed4fbbf830f27e45989c5ccb3543bc63271b9
- MD5 04e7065461fb2f84001cad1f71a0638d
- SHA1 d6b5b8e2c8c86eba156dbd84542ef885c73d60f8
- SHA512 45b4f4f9e893fc0bafb68365b6efcefa5fd1de98f46b1df3d99b0b96c97756bfe02524d7892c127e64c224e90a709e44eb3c092ed91a1f4575ba75d5c4eaaaad
- SSDEEP 393216:/+S+JEKUxqnvQbntd78v4Mn/R1Ft+XEOThs26Jk2NPJsv:m9tUxgvOj7ZM/Lb+XFH6Jk25w
- TLSH T1C827D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE