General
- Target 2026-04-20_7cc211f0e2d3606f3e869fd41c94adcc_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_glassworm_hawkeye_icedid_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_vidar
- Size 11.9MB
- Sample260420-eptppagx3n
- SHA256 6f77cddd3c191532f1679de4b9530f7c4493f1a03a9b43d4e8f75ff02901e02d
- MD5 7cc211f0e2d3606f3e869fd41c94adcc
- SHA1 0fc1aeb2912738b2c4d599b24a715a3e43af0e5d
- SHA512 029ff2407bc41e2bf11c256be45107463a4ca53d71504c385a893ee6cddb44ec729255d06aa4da2a73cfb8b7795882e54404c36d492f199b56549e869a90c8bf
- SSDEEP 98304:BllR0llR35B2cPK8xl1MbQ9yDAD7KjjqkusjmqMhq1/tr37wr://C/35YCK+1tIDewjqkjiqM0G
- TLSH T14BC68D299BB881E5F9ABD47D99778632FA723C140A32934F4AD0C61E6F332914D39731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-20_7cc211f0e2d3606f3e869fd41c94adcc_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_glass.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-20_7cc211f0e2d3606f3e869fd41c94adcc_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_glass.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-20_7cc211f0e2d3606f3e869fd41c94adcc_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_glassworm_hawkeye_icedid_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_vidar
- Size 11.9MB
- SHA256 6f77cddd3c191532f1679de4b9530f7c4493f1a03a9b43d4e8f75ff02901e02d
- MD5 7cc211f0e2d3606f3e869fd41c94adcc
- SHA1 0fc1aeb2912738b2c4d599b24a715a3e43af0e5d
- SHA512 029ff2407bc41e2bf11c256be45107463a4ca53d71504c385a893ee6cddb44ec729255d06aa4da2a73cfb8b7795882e54404c36d492f199b56549e869a90c8bf
- SSDEEP 98304:BllR0llR35B2cPK8xl1MbQ9yDAD7KjjqkusjmqMhq1/tr37wr://C/35YCK+1tIDewjqkjiqM0G
- TLSH T14BC68D299BB881E5F9ABD47D99778632FA723C140A32934F4AD0C61E6F332914D39731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
AutoIT Executable
AutoIT scripts compiled to PE executables.