General
- Target 2026-04-24_3d87a50b08ea536ff6ed6ba22c5a6a59_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stop_vidar_wannacry
- Size 13.5MB
- Sample260424-e3h54sey6x
- SHA256 447c6c6cc0744b78a94fb84c080e885869aeb7d4ee2a5352c6c98f13f0081feb
- MD5 3d87a50b08ea536ff6ed6ba22c5a6a59
- SHA1 e20b0f6fdc71e6c1320d55775c75147edc6ae614
- SHA512 ddd81f7b02ca6b3613e83fe750cefcca1294ab6fb64376ee59dc884beac547bbfae4e03627c5bb872b685b24feb0856c23054263abb7611fe522a561aee74ca9
- SSDEEP 196608:M/q5CKRatoKWQc0gEYnvL4r1yM/q5CKRatoKWQc0gEYnvL4r1yXjn:5YRXcZEIvuy5YRXcZEIvuyXD
- TLSH T1E0E67C1176D54535E5B726314A7992685A7A7C208F338ECF13801EEEBFB1AC09A39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-24_3d87a50b08ea536ff6ed6ba22c5a6a59_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_hellok.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_3d87a50b08ea536ff6ed6ba22c5a6a59_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_hellok.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-24_3d87a50b08ea536ff6ed6ba22c5a6a59_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stop_vidar_wannacry
- Size 13.5MB
- SHA256 447c6c6cc0744b78a94fb84c080e885869aeb7d4ee2a5352c6c98f13f0081feb
- MD5 3d87a50b08ea536ff6ed6ba22c5a6a59
- SHA1 e20b0f6fdc71e6c1320d55775c75147edc6ae614
- SHA512 ddd81f7b02ca6b3613e83fe750cefcca1294ab6fb64376ee59dc884beac547bbfae4e03627c5bb872b685b24feb0856c23054263abb7611fe522a561aee74ca9
- SSDEEP 196608:M/q5CKRatoKWQc0gEYnvL4r1yM/q5CKRatoKWQc0gEYnvL4r1yXjn:5YRXcZEIvuy5YRXcZEIvuyXD
- TLSH T1E0E67C1176D54535E5B726314A7992685A7A7C208F338ECF13801EEEBFB1AC09A39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
AutoIT Executable
AutoIT scripts compiled to PE executables.