General
- Target 2026-08-15_2c1e418bc2b1c03d062308a4216020f6_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260815-ngxk2sfd77
- SHA256 fd825b32853bf0a8af2965eff724c3565f8a8c12abac646a75160c7924174320
- MD5 2c1e418bc2b1c03d062308a4216020f6
- SHA1 5feb0fa02b47e5100c25b98b27ed841d8cd5a87f
- SHA512 66604cede7ef2bb3b6706fa3022043cc02a3690142a1196be3498377e8a6428f9f74faa9a92cf45ad220cc4211d089b489e3cab012bac4f22fd57bae10531db9
- SSDEEP 196608:EJlvi/1n/R15fmmpiLHgWKL6qW4LTK+ZrscB3dTdgn5ZjBxcO42jV2VNUUPJ1mhH:EXv41n/R1FtOXEdThBb6Jz2NDJsh
- TLSH T180D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-15_2c1e418bc2b1c03d062308a4216020f6_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_2c1e418bc2b1c03d062308a4216020f6_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-15_2c1e418bc2b1c03d062308a4216020f6_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 fd825b32853bf0a8af2965eff724c3565f8a8c12abac646a75160c7924174320
- MD5 2c1e418bc2b1c03d062308a4216020f6
- SHA1 5feb0fa02b47e5100c25b98b27ed841d8cd5a87f
- SHA512 66604cede7ef2bb3b6706fa3022043cc02a3690142a1196be3498377e8a6428f9f74faa9a92cf45ad220cc4211d089b489e3cab012bac4f22fd57bae10531db9
- SSDEEP 196608:EJlvi/1n/R15fmmpiLHgWKL6qW4LTK+ZrscB3dTdgn5ZjBxcO42jV2VNUUPJ1mhH:EXv41n/R1FtOXEdThBb6Jz2NDJsh
- TLSH T180D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE