General
- Target 2026-08-15_18003a41ff9e21a11e144ae4b51b8c8c_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260815-lrwqdshr2x
- SHA256 a0962f5fce08f97809c73c574994cba3f01b8269a62566710fb93b90fd9bdaf1
- MD5 18003a41ff9e21a11e144ae4b51b8c8c
- SHA1 e835960f06044e11b97ff8c12bdae846358b0340
- SHA512 e009c2ff5ed1f560154800981627d720ca8b5604576ecd450381836cb0458f46a5cd3b4397468f530552845c587a023b194c0047302e2a81d8ed2056ee766a9e
- SSDEEP 196608:EP0vi/M5sv15fmmpL2HgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4TjV2VNAHPT1m+H:E8v4M5sv1FtEj29ThYMSJk2NETs+
- TLSH T168D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-15_18003a41ff9e21a11e144ae4b51b8c8c_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_18003a41ff9e21a11e144ae4b51b8c8c_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-15_18003a41ff9e21a11e144ae4b51b8c8c_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 a0962f5fce08f97809c73c574994cba3f01b8269a62566710fb93b90fd9bdaf1
- MD5 18003a41ff9e21a11e144ae4b51b8c8c
- SHA1 e835960f06044e11b97ff8c12bdae846358b0340
- SHA512 e009c2ff5ed1f560154800981627d720ca8b5604576ecd450381836cb0458f46a5cd3b4397468f530552845c587a023b194c0047302e2a81d8ed2056ee766a9e
- SSDEEP 196608:EP0vi/M5sv15fmmpL2HgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4TjV2VNAHPT1m+H:E8v4M5sv1FtEj29ThYMSJk2NETs+
- TLSH T168D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE