General
- Target 2026-04-22_6a7e20bbfb3e18adaff46a86cc2b0567_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_poet-rat_remcos_satacom_smoke-loader_stealc_vidar
- Size 14.7MB
- Sample260422-l52tkacy8p
- SHA256 c1595ce6b565213503b20a5d53e541680204f9b9db45cedc5f7444e82f2de482
- MD5 6a7e20bbfb3e18adaff46a86cc2b0567
- SHA1 ce44637195dbd544451f99e94d53a75fa81d8a70
- SHA512 b7615464a48c58dd1d21d1f575783dca7e88dba99e810f7e4add8c27822e9cc40f2c42775eeeb0496c67885c3d1abbbe49b76e7af1d0fad61997d63c8fbce363
- SSDEEP 196608:+FIF0wuPlCKj1tIDewjqkjiqMMHh6ImzD+F:4Ue8KwekyT
- TLSH T1A4F69D25EBE980F1F96795349877823BE63179004633878BD694CA5EEF336D14E26332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-22_6a7e20bbfb3e18adaff46a86cc2b0567_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-22_6a7e20bbfb3e18adaff46a86cc2b0567_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-22_6a7e20bbfb3e18adaff46a86cc2b0567_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_poet-rat_remcos_satacom_smoke-loader_stealc_vidar
- Size 14.7MB
- SHA256 c1595ce6b565213503b20a5d53e541680204f9b9db45cedc5f7444e82f2de482
- MD5 6a7e20bbfb3e18adaff46a86cc2b0567
- SHA1 ce44637195dbd544451f99e94d53a75fa81d8a70
- SHA512 b7615464a48c58dd1d21d1f575783dca7e88dba99e810f7e4add8c27822e9cc40f2c42775eeeb0496c67885c3d1abbbe49b76e7af1d0fad61997d63c8fbce363
- SSDEEP 196608:+FIF0wuPlCKj1tIDewjqkjiqMMHh6ImzD+F:4Ue8KwekyT
- TLSH T1A4F69D25EBE980F1F96795349877823BE63179004633878BD694CA5EEF336D14E26332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.