General
- Target 2026-04-20_8e6b67c5425bab4c75e7a5e8c3d367d3_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_stop_vidar
- Size 10.3MB
- Sample260420-brtkxsbs3v
- SHA256 4e120585b160a96a41e90a69763aba17f5a17e6488a5781bafbe4db3496d2f3f
- MD5 8e6b67c5425bab4c75e7a5e8c3d367d3
- SHA1 05c0c57a6e1a6cbf6b86ba3bf7797eaeae6b6e57
- SHA512 9f4e6de81c7db014664e4c9b2a3be923574ae60098918c3973ac564c08dda17971b9ec462d1fb8b295b1d7588d61c0452982aeba21d8b6021f9e288fad32b4bf
- SSDEEP 196608:2CX7mtvwOrCK0uj6C+CX7mtvwOrCK0ujLFjn:2ZvwAGrZvwAND
- TLSH T1F7B68C1177D49D71E5B705314B7692694A3ABC208F228ACF22843E9EBFB12D17939733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-20_8e6b67c5425bab4c75e7a5e8c3d367d3_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_hijack.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-20_8e6b67c5425bab4c75e7a5e8c3d367d3_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_hijack.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-20_8e6b67c5425bab4c75e7a5e8c3d367d3_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_stop_vidar
- Size 10.3MB
- SHA256 4e120585b160a96a41e90a69763aba17f5a17e6488a5781bafbe4db3496d2f3f
- MD5 8e6b67c5425bab4c75e7a5e8c3d367d3
- SHA1 05c0c57a6e1a6cbf6b86ba3bf7797eaeae6b6e57
- SHA512 9f4e6de81c7db014664e4c9b2a3be923574ae60098918c3973ac564c08dda17971b9ec462d1fb8b295b1d7588d61c0452982aeba21d8b6021f9e288fad32b4bf
- SSDEEP 196608:2CX7mtvwOrCK0uj6C+CX7mtvwOrCK0ujLFjn:2ZvwAGrZvwAND
- TLSH T1F7B68C1177D49D71E5B705314B7692694A3ABC208F228ACF22843E9EBFB12D17939733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.