General
- Target 2026-04-23_cc314cbf43b69a6c7a0276880d0480e6_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_stop_vidar_wannacry
- Size 6.1MB
- Sample260423-xd7fhsft81
- SHA256 3112a67fe4da104ae604495e9c88f2f8cd419c9e6f80c5a50864e93fb3313c86
- MD5 cc314cbf43b69a6c7a0276880d0480e6
- SHA1 ba42972cf1959c6c5299a31f57e79b22d765f347
- SHA512 ef70670dae875f81c81a3fc4765e66ac0fb01f4f1cc3cbf72a26d4d43dae1de560a685c6184e9063ae6200348fd19478a0329994529f2d5b3a13b260426bfdd4
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xQn7OmEmp7mT:equFIF0wuPlCK1nSmE0mT
- TLSH T1CA569D1276D08071E5B215314A69A22D5679B861C6338E9F738C1EDEFFF16C18E39B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-04-23_cc314cbf43b69a6c7a0276880d0480e6_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win10v2004-20260130-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_cc314cbf43b69a6c7a0276880d0480e6_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win11-20260130-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-23_cc314cbf43b69a6c7a0276880d0480e6_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_stop_vidar_wannacry
- Size 6.1MB
- SHA256 3112a67fe4da104ae604495e9c88f2f8cd419c9e6f80c5a50864e93fb3313c86
- MD5 cc314cbf43b69a6c7a0276880d0480e6
- SHA1 ba42972cf1959c6c5299a31f57e79b22d765f347
- SHA512 ef70670dae875f81c81a3fc4765e66ac0fb01f4f1cc3cbf72a26d4d43dae1de560a685c6184e9063ae6200348fd19478a0329994529f2d5b3a13b260426bfdd4
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xQn7OmEmp7mT:equFIF0wuPlCK1nSmE0mT
- TLSH T1CA569D1276D08071E5B215314A69A22D5679B861C6338E9F738C1EDEFFF16C18E39B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.