General
- Target 2026-04-20_4fd1529d08736875ad031a817fe7f2ea_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_glassworm_hawkeye_icedid_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_vidar
- Size 17.2MB
- Sample260420-wfktvsbv2m
- SHA256 75de3e1cfe4b3a3bf430a1b4f7e89db3641ded4c704ad2ef538a90cca4b60e3a
- MD5 4fd1529d08736875ad031a817fe7f2ea
- SHA1 51d2ca91cc8ddced3d8eccd3ebdb43feea7705a8
- SHA512 086ea15f1b97c2ed1a62f3d1ade2015c1266ca39a9d7c0bc3a4e6bcb9c90e5e70ef79510962f83fba92d6ac91c71e52f848e432f446a9942325a0c92c4452a93
- SSDEEP 196608:v/35YCKT/C/35YCK+1tIDewjqkjiqMUSmHpn6F44IAWvc:v/357m/C/357D8KwekybmHN6+Jrvc
- TLSH T10A078D65A7F690E9F9AFD4399977C331EA723C120632534F06B8C61A2F336905D29732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-20_4fd1529d08736875ad031a817fe7f2ea_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_glass.exe
Resource
win10v2004-20260130-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-20_4fd1529d08736875ad031a817fe7f2ea_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_glass.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-20_4fd1529d08736875ad031a817fe7f2ea_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_glassworm_hawkeye_icedid_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_vidar
- Size 17.2MB
- SHA256 75de3e1cfe4b3a3bf430a1b4f7e89db3641ded4c704ad2ef538a90cca4b60e3a
- MD5 4fd1529d08736875ad031a817fe7f2ea
- SHA1 51d2ca91cc8ddced3d8eccd3ebdb43feea7705a8
- SHA512 086ea15f1b97c2ed1a62f3d1ade2015c1266ca39a9d7c0bc3a4e6bcb9c90e5e70ef79510962f83fba92d6ac91c71e52f848e432f446a9942325a0c92c4452a93
- SSDEEP 196608:v/35YCKT/C/35YCK+1tIDewjqkjiqMUSmHpn6F44IAWvc:v/357m/C/357D8KwekybmHN6+Jrvc
- TLSH T10A078D65A7F690E9F9AFD4399977C331EA723C120632534F06B8C61A2F336905D29732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
AutoIT Executable
AutoIT scripts compiled to PE executables.