General
- Target 2026-04-19_23df00b1b958bb4fe961fd4d6abc0e4b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_poet-rat_remcos_satacom_stop_vidar_wannacry
- Size 22.2MB
- Sample260419-3vbcashs8t
- SHA256 cd31c6570ec1154347160f0d65ea49546ecc7dea885e34afedec0c3f6af10640
- MD5 23df00b1b958bb4fe961fd4d6abc0e4b
- SHA1 023f68e60f05e57d1f57fb6b81fd54bac1f683d0
- SHA512 6346763278b45d8d3b9963ca9552421f040a88c04454f059874a2766844d71b32137d0d4bc25a8441367885835606055949b16dcf4b06bca5728d4b63de62c95
- SSDEEP 196608:Mo5aCKoaHo5aCKoaHo5aCKoaHo5aCKoaHo5aCKoaHo5aCKoaL1yJHh6ImzD+F:n5xII5xII5xII5xII5xII5xIRyE
- TLSH T1B4376C01B7D68071F66356314966926E5A397C108B338ECF53842EEDFFB16D09A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-19_23df00b1b958bb4fe961fd4d6abc0e4b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-19_23df00b1b958bb4fe961fd4d6abc0e4b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-19_23df00b1b958bb4fe961fd4d6abc0e4b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_poet-rat_remcos_satacom_stop_vidar_wannacry
- Size 22.2MB
- SHA256 cd31c6570ec1154347160f0d65ea49546ecc7dea885e34afedec0c3f6af10640
- MD5 23df00b1b958bb4fe961fd4d6abc0e4b
- SHA1 023f68e60f05e57d1f57fb6b81fd54bac1f683d0
- SHA512 6346763278b45d8d3b9963ca9552421f040a88c04454f059874a2766844d71b32137d0d4bc25a8441367885835606055949b16dcf4b06bca5728d4b63de62c95
- SSDEEP 196608:Mo5aCKoaHo5aCKoaHo5aCKoaHo5aCKoaHo5aCKoaHo5aCKoaL1yJHh6ImzD+F:n5xII5xII5xII5xII5xII5xIRyE
- TLSH T1B4376C01B7D68071F66356314966926E5A397C108B338ECF53842EEDFFB16D09A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
AutoIT Executable
AutoIT scripts compiled to PE executables.