General
- Target 2026-04-19_179d1b16159087b8a206d2b01eee500f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_poet-rat_remcos_satacom_smoke-loader_stealc_vidar
- Size 10.7MB
- Sample260419-d1wsrag16x
- SHA256 15672e0425bb96607098fe0559c0483b7503bf1c8781811d063164d2904d3310
- MD5 179d1b16159087b8a206d2b01eee500f
- SHA1 11054c562e9118be84e532296638a56d5938f5a5
- SHA512 c9e3249f80b08d0bd9223ba8ca48fe80a9e121f35fa3a8fbdbe827bb21b5763fc33c630015c6862a825c1c6bcc887de4b2c17bf4fdc0ea7305caab24ba5ef633
- SSDEEP 98304:Q5B2cPK8xh5B2cPK8xS1/tr37wsA+4jJ/fh6ImzzJoDfuBcMv+A73XAHPF:Q5YCKs5YCK7BujJHh6ImzD+FHP
- TLSH T131B6AE01E7EA80B0E65781318967E26BE7317C0C4731D7DBC6805E6AAE777E15E3A312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-19_179d1b16159087b8a206d2b01eee500f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-19_179d1b16159087b8a206d2b01eee500f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-19_179d1b16159087b8a206d2b01eee500f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_poet-rat_remcos_satacom_smoke-loader_stealc_vidar
- Size 10.7MB
- SHA256 15672e0425bb96607098fe0559c0483b7503bf1c8781811d063164d2904d3310
- MD5 179d1b16159087b8a206d2b01eee500f
- SHA1 11054c562e9118be84e532296638a56d5938f5a5
- SHA512 c9e3249f80b08d0bd9223ba8ca48fe80a9e121f35fa3a8fbdbe827bb21b5763fc33c630015c6862a825c1c6bcc887de4b2c17bf4fdc0ea7305caab24ba5ef633
- SSDEEP 98304:Q5B2cPK8xh5B2cPK8xS1/tr37wsA+4jJ/fh6ImzzJoDfuBcMv+A73XAHPF:Q5YCKs5YCK7BujJHh6ImzD+FHP
- TLSH T131B6AE01E7EA80B0E65781318967E26BE7317C0C4731D7DBC6805E6AAE777E15E3A312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.