General
- Target 2026-08-18_837fbc5c78035766c8b7b1016d56624a_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- Sample260818-r98essthrf
- SHA256 a88e71444d839b81c94cee19a89c101c3c233ec0b2b0e9e457106b4845cc73ea
- MD5 837fbc5c78035766c8b7b1016d56624a
- SHA1 3e2795f3f3f88b6fd8c375e47755b5749ec08c0a
- SHA512 b47f023d7c1fda6eacc9cec6e155104521738c8797d95596d136a6e2ab4a12131d4457b6bc7dd586050dc627f0d95c08f20ecfe241d4fdb50a46a6a6927725f1
- SSDEEP 196608:EP0vi/Mn/R1ifJmjiIHgWKL6qwhLFK+Z1u4B3tpdgT/ZjBxcO4zjV2VNIbPS1m+H:E8v4Mn/R1wUnXEGFnrhIJE2NISs+
- TLSH T12DD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-18_837fbc5c78035766c8b7b1016d56624a_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-18_837fbc5c78035766c8b7b1016d56624a_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-18_837fbc5c78035766c8b7b1016d56624a_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
- Size 12.9MB
- SHA256 a88e71444d839b81c94cee19a89c101c3c233ec0b2b0e9e457106b4845cc73ea
- MD5 837fbc5c78035766c8b7b1016d56624a
- SHA1 3e2795f3f3f88b6fd8c375e47755b5749ec08c0a
- SHA512 b47f023d7c1fda6eacc9cec6e155104521738c8797d95596d136a6e2ab4a12131d4457b6bc7dd586050dc627f0d95c08f20ecfe241d4fdb50a46a6a6927725f1
- SSDEEP 196608:EP0vi/Mn/R1ifJmjiIHgWKL6qwhLFK+Z1u4B3tpdgT/ZjBxcO4zjV2VNIbPS1m+H:E8v4Mn/R1wUnXEGFnrhIJE2NISs+
- TLSH T12DD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects KawaiiUnicorn
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE