General
- Target 2026-04-20_d2e52d5a467f2c63f2d21b31d1e53882_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_poet-rat_remcos_satacom_smoke-loader_stealc_vidar
- Size 11.5MB
- Sample260420-nrtbdag13j
- SHA256 5c23aa1f0a3e94a73ab45a32c33cce5279651b0160f1e2978b86bfdd67c1e45a
- MD5 d2e52d5a467f2c63f2d21b31d1e53882
- SHA1 33fed21713f4947b2006fc454504251ea03b620d
- SHA512 6027ac5fe40bd5e09b64c49a04f26b3e713294f05d9fa9747702d737857ba316eeef43d2f8480f7f9837c921acebf010309dc3987b72b267a3bea6795bf52e9d
- SSDEEP 98304:eOU/jIEeQfoR/IuOFVjUu55K2cPK8xG1/tr37wF/fh6ImzzJoDfuBcMv+A73XA:eFIF0wuPlCKjQHh6ImzD+F
- TLSH T15AC69E01EADA80B1E55381304967921FE7317C098732DADBE7845EAEAF737D14E36722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-20_d2e52d5a467f2c63f2d21b31d1e53882_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-20_d2e52d5a467f2c63f2d21b31d1e53882_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-20_d2e52d5a467f2c63f2d21b31d1e53882_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_poet-rat_remcos_satacom_smoke-loader_stealc_vidar
- Size 11.5MB
- SHA256 5c23aa1f0a3e94a73ab45a32c33cce5279651b0160f1e2978b86bfdd67c1e45a
- MD5 d2e52d5a467f2c63f2d21b31d1e53882
- SHA1 33fed21713f4947b2006fc454504251ea03b620d
- SHA512 6027ac5fe40bd5e09b64c49a04f26b3e713294f05d9fa9747702d737857ba316eeef43d2f8480f7f9837c921acebf010309dc3987b72b267a3bea6795bf52e9d
- SSDEEP 98304:eOU/jIEeQfoR/IuOFVjUu55K2cPK8xG1/tr37wF/fh6ImzzJoDfuBcMv+A73XA:eFIF0wuPlCKjQHh6ImzD+F
- TLSH T15AC69E01EADA80B1E55381304967921FE7317C098732DADBE7845EAEAF737D14E36722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.