General
- Target 2026-08-14_3224482a127ebfa79ac1d2b350831d91_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 10.1MB
- Sample260815-ads7kavbme
- SHA256 a7a7bbaf8f5516812f651fdbc0a86c16d727e65a67e1d07009818c1937568298
- MD5 3224482a127ebfa79ac1d2b350831d91
- SHA1 d08e020a5f6f735295ad2eef1e9a96e2b30113cc
- SHA512 9bd93381bc250b89ca862e05a8f4762f31d0cce1356895aae4943171819e38ccd12e5401cfb7bd5f2c1f1169ab4e377a662465080382541a3588b348ecb06193
- SSDEEP 196608:EPGvi/Mn/R15fmmpL0HSWKLGqw3LSn+ZsicB3tqdIn5ZjBxcO4T:E+v4Mn/R1FtaREQSTryCJ
- TLSH T106B6F125EAA40EF4F473913846A2D526D2757C3A572087CF2398FA0A2F337E1593E716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-14_3224482a127ebfa79ac1d2b350831d91_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_3224482a127ebfa79ac1d2b350831d91_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-14_3224482a127ebfa79ac1d2b350831d91_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 10.1MB
- SHA256 a7a7bbaf8f5516812f651fdbc0a86c16d727e65a67e1d07009818c1937568298
- MD5 3224482a127ebfa79ac1d2b350831d91
- SHA1 d08e020a5f6f735295ad2eef1e9a96e2b30113cc
- SHA512 9bd93381bc250b89ca862e05a8f4762f31d0cce1356895aae4943171819e38ccd12e5401cfb7bd5f2c1f1169ab4e377a662465080382541a3588b348ecb06193
- SSDEEP 196608:EPGvi/Mn/R15fmmpL0HSWKLGqw3LSn+ZsicB3tqdIn5ZjBxcO4T:E+v4Mn/R1FtaREQSTryCJ
- TLSH T106B6F125EAA40EF4F473913846A2D526D2757C3A572087CF2398FA0A2F337E1593E716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE