General
- Target 2026-08-12_a59140169fbcb130e65c7e8fdc87f308_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260812-kfgawsdj8s
- SHA256 aa590a95f1aa758fc015e4b3601218625fe9c69c2cb5db4e571db6eb2a1bc895
- MD5 a59140169fbcb130e65c7e8fdc87f308
- SHA1 a3ab640448b8d8ac01f68971b74f486d656b1511
- SHA512 54e7b3b192efcc03b4bb8c481683b845ebf723f6bd954b2fe7824e13799802c622750ab4cbd8e8a4d2aad123f225ce0b4c094bf4e29dd643a2b5566456b5f66f
- SSDEEP 196608:EiVvi/Mn/R15fmmpLDHgsKLOqw5LTK+ZrYnB3tTdgn5ZjPxcA4TQV2VNgfPJ1u+H:Eqv4Mn/R1FtnFESThWr65t2NMJU+
- TLSH T1E1D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-12_a59140169fbcb130e65c7e8fdc87f308_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_a59140169fbcb130e65c7e8fdc87f308_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-12_a59140169fbcb130e65c7e8fdc87f308_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 aa590a95f1aa758fc015e4b3601218625fe9c69c2cb5db4e571db6eb2a1bc895
- MD5 a59140169fbcb130e65c7e8fdc87f308
- SHA1 a3ab640448b8d8ac01f68971b74f486d656b1511
- SHA512 54e7b3b192efcc03b4bb8c481683b845ebf723f6bd954b2fe7824e13799802c622750ab4cbd8e8a4d2aad123f225ce0b4c094bf4e29dd643a2b5566456b5f66f
- SSDEEP 196608:EiVvi/Mn/R15fmmpLDHgsKLOqw5LTK+ZrYnB3tTdgn5ZjPxcA4TQV2VNgfPJ1u+H:Eqv4Mn/R1FtnFESThWr65t2NMJU+
- TLSH T1E1D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE