2026-09-26_786fc1820170af201becf6adedfd8839_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar
Multi-stage malware with miner, AV evasion
Kawaii-Unicorn writes randomized executable replicasExecutes shell commands renaming files to .die
SHA-25610bc7a91c7e89932c941b4b93185b3a770852e86782b48d56124b3aa7f697bbf
Evidence
⋯7 more rows
0x2286cda5b4a100000000000000000003800l.[J..........8.
0x2384d535642564d36302e444c4c00000000MSVBVM60.DLL....
0x24800000000000000000000000000000000................
⋯15 more rows
⋯8 more rows
0x2924087000000960000009700000000000000................
0x292500000000000e90000000000004b617761............Kawa
0x2926069692d556e69636f726e004b61776169ii-Unicorn.Kawai
0x29270692d556e69636f726e00005662310000i-Unicorn..Vb1..
⋯15 more rows
⋯3 more rows
0x299002e3dfbfcfaa06810a73808002b3371b5.=....h..8..+3q.
0x29910433a5c50726f6772616d2046696c6573C:\Program Files
0x299202028783836295c4d6963726f736f6674 (x86)\Microsoft
0x299302056697375616c2053747564696f5c56 Visual Studio\V
0x299404239385c5642362e4f4c420056420000B98\VB6.OLB.VB..
0x2995000994200000000000600000009000000..B.............
⋯6 more rows
0x299c054696d65723100000700000075736572Timer1......user
0x299d0333200001b0000005365744c6179657232......SetLayer
0x299e0656457696e646f774174747269627574edWindowAttribut
0x299f065730000cc994200d899420000000400es....B...B.....
0x29a00d4c242000000000000000000a1dcc242..B............B
0x29a10000bc07402ffe068f4994200b8d01240...t...h..B....@
0x29a2000ffd0ffe00000000f00000047657457............GetW
0x29a30696e646f774c6f6e67410000cc994200indowLongA....B.
0x29a402c9a420000000400e0c2420000000000,.B.......B.....
0x29a5000000000a1e8c242000bc07402ffe068.......B...t...h
0x29a603c9a4200b8d0124000ffd0ffe0000000<.B....@........
0x29a700f00000053657457696e646f774c6f6e....SetWindowLon
0x29a8067410000cc994200749a420000000400gA....B.t.B.....
0x29a90ecc242000000000000000000a1f4c242..B............B
⋯6 more rows
0x29b000060d393020000005c00000008000000.`......\.......
0x29b102e006500780065000000000016000000..e.x.e.........
0x29b2004000000010000000000000000007301..............s.
0x29b30ffffffff01000000d94ead339966cf11.........N.3.f..
0x29b40b70c00aa0060d393120000005c005500.....`......\.U.
0x29b506e00690063006f0072006e002d000000n.i.c.o.r.n.-...
0x29b60e14ead339966cf11b70c00aa00600c93.N.3.f.......`..
0x29b705f5f766261467265655374724c697374__vbaFreeStrList
0x29b80000000001e00000063006d0064002000........c.m.d. .
0x29b902f0063002000720065006e0061006d00/.c. .r.e.n.a.m.
0x29ba065002000220000000c0000002e006500e. .".........e.
0x29bb078006500220020000000000008000000x.e.". .........
0x29bc02e006400690065000000000056424136..d.i.e.....VBA6
0x7479affffffffffffffffffffffffffffffff................
0x747aaffffffffffff00000100010000150000................
0x747ba01002000c87604000100340234000000.. ..v....4.4...
0x747ca560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x747da4f004e005f0049004e0046004f000000O.N._.I.N.F.O...
0x747ea0000bd04effe00000100000001000000................
0x747fa000000000100000000003f0000000000..........?.....
0x7480a00000400000001000000000000000000................
0x7481a00000000000094010000000053007400............S.t.
0x7482a720069006e006700460069006c006500r.i.n.g.F.i.l.e.
0x7483a49006e0066006f000000700100000000I.n.f.o...p.....
0x7484a300038003000340030003400420030000.8.0.4.0.4.B.0.
0x7485a00002c000a00010043006f006d007000..,.....C.o.m.p.
0x7486a61006e0079004e0061006d0065000000a.n.y.N.a.m.e...
0x7487a00005500450046004900000000004000..U.E.F.I.....@.
0x7488a1e000100500072006f00640075006300....P.r.o.d.u.c.
0x7489a74004e0061006d006500000000004b00t.N.a.m.e.....K.
0x748aa610077006100690069002d0055006e00a.w.a.i.i.-.U.n.
0x748ba690063006f0072006e00000000002c00i.c.o.r.n.....,.
0x748ca0a000100460069006c00650056006500....F.i.l.e.V.e.
0x748da7200730069006f006e00000000003100r.s.i.o.n.....1.
0x748ea2e00300030000000000030000a000100..0.0.....0.....
0x748fa500072006f0064007500630074005600P.r.o.d.u.c.t.V.
0x7490a65007200730069006f006e0000003100e.r.s.i.o.n...1.
0x7491a2e00300030000000000040001e000100..0.0.....@.....
0x7492a49006e007400650072006e0061006c00I.n.t.e.r.n.a.l.
0x7493a4e0061006d00650000004b0061007700N.a.m.e...K.a.w.
0x7494a6100690069002d0055006e0069006300a.i.i.-.U.n.i.c.
0x7495a6f0072006e0000000000500026000100o.r.n.....P.&...
0x7496a4f0072006900670069006e0061006c00O.r.i.g.i.n.a.l.
0x7497a460069006c0065006e0061006d006500F.i.l.e.n.a.m.e.
0x7498a00004b00610077006100690069002d00..K.a.w.a.i.i.-.
0x7499a55006e00690063006f0072006e002e00U.n.i.c.o.r.n...
0x749aa65007800650000000000440000000000e.x.e.....D.....
0x749ba560061007200460069006c0065004900V.a.r.F.i.l.e.I.
0x749ca6e0066006f0000000000240004000000n.f.o.....$.....
0x749da5400720061006e0073006c0061007400T.r.a.n.s.l.a.t.
0x749ea69006f006e00000000000408b0040000i.o.n...........
0x749fa00000000000000000000000000000000................
0x74a0a00000000000000000000000000000000................
0x74a1a00000000000000000000000000000000................
0x74a2a00000000000000000000000000000000................
0x74a3a00000000000000000000000000000000................
0x74a4a000000000000000000a4000000000000................
0x74a5a00000000000000000000000000000000................
0x74a6a00000000000000000000000000000000................
0x74a7a00000000000000000000000000000000................
0x74a8a00000000000000000000000000000000................
⋯6 more rows
0x76d3720646562756767696e67207676767676 debugging vvvvv
0x76d47200d0a20202020202020205374617274 .. Start
0x76d572d50726f6365737320706f7765727368-Process powersh
0x76d67656c6c2e657865202d56657262205275ell.exe -Verb Ru
0x76d776e4173202d417267756d656e744c6973nAs -ArgumentLis
0x76d87742028272d6e6f70726f66696c65202dt ('-noprofile -
0x76d9766696c6520227b307d22202d73686f75file "{0}" -shou
⋯13 more rows