General
- Target 2026-04-24_1369e4de411172d92b216f1048f543cf_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_remcos_satacom_stop_vidar_wannacry
- Size 2.9MB
- Sample260425-ae65tahs2s
- SHA256 a0eec9d60b449edba46d5d43b407e60505c3c96096a0f1a9255c69233cd0c49c
- MD5 1369e4de411172d92b216f1048f543cf
- SHA1 329ab8d56b66b17f089adfb005d622ecfe2880d1
- SHA512 fc47ce6898960fdf7027f2b166c0a95a68e0c1002039ae4bd5fd10c009d422cd6600f929c7e3ab8ea12998b80d4fba23ecd01339a8a79072b25724c44cc8a31a
- SSDEEP 49152:gh+ZkldoPK8YahFHRDY5Flh+ZkldoPK8YahFHRDY5FwDd79WC7:B2cPK8x+502cPK8x+5ip7V
- TLSH T166E5AE1677D19036FFA795728B6AE291AE7978200733869F23843D796D305F0A63E313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-24_1369e4de411172d92b216f1048f543cf_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_remcos.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_1369e4de411172d92b216f1048f543cf_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_remcos.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-24_1369e4de411172d92b216f1048f543cf_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_remcos_satacom_stop_vidar_wannacry
- Size 2.9MB
- SHA256 a0eec9d60b449edba46d5d43b407e60505c3c96096a0f1a9255c69233cd0c49c
- MD5 1369e4de411172d92b216f1048f543cf
- SHA1 329ab8d56b66b17f089adfb005d622ecfe2880d1
- SHA512 fc47ce6898960fdf7027f2b166c0a95a68e0c1002039ae4bd5fd10c009d422cd6600f929c7e3ab8ea12998b80d4fba23ecd01339a8a79072b25724c44cc8a31a
- SSDEEP 49152:gh+ZkldoPK8YahFHRDY5Flh+ZkldoPK8YahFHRDY5FwDd79WC7:B2cPK8x+502cPK8x+5ip7V
- TLSH T166E5AE1677D19036FFA795728B6AE291AE7978200733869F23843D796D305F0A63E313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
AutoIT Executable
AutoIT scripts compiled to PE executables.