General
- Target 2026-08-17_4d801d652ce8a8bb4223c54be77b9963_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260818-dx96zadn2y
- SHA256 334aa0c32cc21f65c82d44c9f49250427a2b95348ec4e5c92621662716e6b258
- MD5 4d801d652ce8a8bb4223c54be77b9963
- SHA1 f35e9f87338e82284bff81b1f2649fdd275ec6b8
- SHA512 f68a1ef6db500d5b935da97655dcbde591f17797ad1a673b0d83bfe439f6720864bee912fdf8a221ec32b1db80979d1660bf2143b3ad125875dcc9aac7fd3e4d
- SSDEEP 196608:EP2vimMn/R15fmmpLDHgvKL6qwrtTK+ZrXcBEtTdgn5ZjBxcO4ujV2lNgS3E1mMH:EevxMn/R1FtnuEWThsu6JrmN1EsM
- TLSH T16AD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-17_4d801d652ce8a8bb4223c54be77b9963_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_4d801d652ce8a8bb4223c54be77b9963_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-17_4d801d652ce8a8bb4223c54be77b9963_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 334aa0c32cc21f65c82d44c9f49250427a2b95348ec4e5c92621662716e6b258
- MD5 4d801d652ce8a8bb4223c54be77b9963
- SHA1 f35e9f87338e82284bff81b1f2649fdd275ec6b8
- SHA512 f68a1ef6db500d5b935da97655dcbde591f17797ad1a673b0d83bfe439f6720864bee912fdf8a221ec32b1db80979d1660bf2143b3ad125875dcc9aac7fd3e4d
- SSDEEP 196608:EP2vimMn/R15fmmpLDHgvKL6qwrtTK+ZrXcBEtTdgn5ZjBxcO4ujV2lNgS3E1mMH:EevxMn/R1FtnuEWThsu6JrmN1EsM
- TLSH T16AD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE