Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/04/2026, 03:59
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-24_5ed04588456d29c79409c97e888d1920_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_ele.exe
Resource
win10v2004-20260130-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_5ed04588456d29c79409c97e888d1920_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_ele.exe
Resource
win11-20260130-en
1 signatures
150 seconds
General
- Target 2026-04-24_5ed04588456d29c79409c97e888d1920_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_ele.exe
- Size 18.6MB
- Sample260424-ej4mpset5z
- SHA256 d9bdcb2c7b667ba398db46cfc42684139e138c65f61864331627ef4e2d654bb9
- MD5 5ed04588456d29c79409c97e888d1920
- SHA1 1379fbad5e982b49d140dbe2715f3b9ed6fd214a
- SHA512 c781dff8cb6e14a2380fc8eab974a6974f3260d48b868a8757afc3258810cf668e440a41d9761c4a597cde7276161560c5444f15a68d2bb5e79723e59a2ab05b
- SSDEEP 393216:JcZEIvUDPgyGTOcZEIvUpcZEIvUDPgyGT:QEIvsonTPEIvzEIvsonT
- TLSH T14217AD1177E58131F5B716329E7992615A7BBC215F31C6CF23C42E2D2E706D0AA3AB23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_5ed04588456d29c79409c97e888d1920_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_ele.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_5ed04588456d29c79409c97e888d1920_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_ele.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_5ed04588456d29c79409c97e888d1920_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_ele.exe"1⤵
- System Location Discovery: System Language Discovery
PID:5020