General
- Target 2026-08-18_8f6316d721050806c4b2465844280b36_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260818-r7c6wathld
- SHA256 958e63b5a60b9af33590de601708914d626e9803c6b979f4a934ca1749b0ef30
- MD5 8f6316d721050806c4b2465844280b36
- SHA1 6cead757c88ddc444d3d17ddc13fd294a9a30e2c
- SHA512 f4b95985072ab0a3774044a1355be3f3934c3985c8bbed2fe4d07883ea8b5d885a33aad09ff1e85b9e1c8b4a388b7bb55e3a4b058ae9dfa178d343748e7cc96b
- SSDEEP 196608:EP0vi/Mn/R1/fJmpiIHgWKL6qwhLFK+Z1u4B3tpdgT/ZjBxcO4zjV2VNIbPS1mJH:E8v4Mn/R1HWnXEGFnrhIJE2NISsJ
- TLSH T1DED6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-18_8f6316d721050806c4b2465844280b36_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-18_8f6316d721050806c4b2465844280b36_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-18_8f6316d721050806c4b2465844280b36_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 958e63b5a60b9af33590de601708914d626e9803c6b979f4a934ca1749b0ef30
- MD5 8f6316d721050806c4b2465844280b36
- SHA1 6cead757c88ddc444d3d17ddc13fd294a9a30e2c
- SHA512 f4b95985072ab0a3774044a1355be3f3934c3985c8bbed2fe4d07883ea8b5d885a33aad09ff1e85b9e1c8b4a388b7bb55e3a4b058ae9dfa178d343748e7cc96b
- SSDEEP 196608:EP0vi/Mn/R1/fJmpiIHgWKL6qwhLFK+Z1u4B3tpdgT/ZjBxcO4zjV2VNIbPS1mJH:E8v4Mn/R1HWnXEGFnrhIJE2NISsJ
- TLSH T1DED6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE