General
- Target 2026-04-21_791bb0c9fe66e7d63c872d6bc6c9e44b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_poet-rat_remcos_satacom_smoke-loader_stealc_stop_vidar
- Size 17.9MB
- Sample260422-bc2b8ae18j
- SHA256 9cf389ec1a6396513e0bf30e3db2f3a5aa817657f9fb11316f3ec636cf6a7ce2
- MD5 791bb0c9fe66e7d63c872d6bc6c9e44b
- SHA1 4e78bdfe4d661d167ddb91cae9e4d3160139da62
- SHA512 f7aba472d481e4e749ffab3ba523722e63300e4f4bee506727166b6071b6fb4ab2d2530fafb1bf623fc033f4e4c44c5c3b8c4766de858948fe6f46506f224764
- SSDEEP 196608:M3KWQc0gEYnvLhCKB1tIDewjqkjiqMUhQHh6ImzD+F:pcZEIvUw8KwekyG/
- TLSH T1B2179D15EBE580F1E967D53999779237E63178050B32938BC690CA2EAF336D14E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-21_791bb0c9fe66e7d63c872d6bc6c9e44b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-21_791bb0c9fe66e7d63c872d6bc6c9e44b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-21_791bb0c9fe66e7d63c872d6bc6c9e44b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_poet-rat_remcos_satacom_smoke-loader_stealc_stop_vidar
- Size 17.9MB
- SHA256 9cf389ec1a6396513e0bf30e3db2f3a5aa817657f9fb11316f3ec636cf6a7ce2
- MD5 791bb0c9fe66e7d63c872d6bc6c9e44b
- SHA1 4e78bdfe4d661d167ddb91cae9e4d3160139da62
- SHA512 f7aba472d481e4e749ffab3ba523722e63300e4f4bee506727166b6071b6fb4ab2d2530fafb1bf623fc033f4e4c44c5c3b8c4766de858948fe6f46506f224764
- SSDEEP 196608:M3KWQc0gEYnvLhCKB1tIDewjqkjiqMUhQHh6ImzD+F:pcZEIvUw8KwekyG/
- TLSH T1B2179D15EBE580F1E967D53999779237E63178050B32938BC690CA2EAF336D14E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.