General
- Target 2026-04-24_559137c5f6dc2dbf45405cf75818cd42_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_poet-rat_remcos_satacom_smoke-loader_stealc_stop_vidar
- Size 19.4MB
- Sample260425-bdbsysav4y
- SHA256 5b6f87270591c3e00e6eb2908254f90e62e71b27e243f61253e8b089630e9a69
- MD5 559137c5f6dc2dbf45405cf75818cd42
- SHA1 66b64ce6156c95367dd6f9cf318493c45ed8ab95
- SHA512 afde3c89cc4ad52f51f07c4c0969fe393fb748afda52d431d7697b7a6aa4b2909ed1ce1e00e81c1bfbdc715f903d387b45b5da402e694de0f7f7a2d942ac2229
- SSDEEP 196608:uquFIF0wuPlCKrjQquFIF0wuPlCK8quFIF0wuPlCKrjinHh6ImzD+F:PoUm1oUqoUm7
- TLSH T1CE27AE01B6D68071E56315314966922E5639B9158B338ECFB38C1EAEFFB1AC14E36733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-24_559137c5f6dc2dbf45405cf75818cd42_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_559137c5f6dc2dbf45405cf75818cd42_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-24_559137c5f6dc2dbf45405cf75818cd42_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_poet-rat_remcos_satacom_smoke-loader_stealc_stop_vidar
- Size 19.4MB
- SHA256 5b6f87270591c3e00e6eb2908254f90e62e71b27e243f61253e8b089630e9a69
- MD5 559137c5f6dc2dbf45405cf75818cd42
- SHA1 66b64ce6156c95367dd6f9cf318493c45ed8ab95
- SHA512 afde3c89cc4ad52f51f07c4c0969fe393fb748afda52d431d7697b7a6aa4b2909ed1ce1e00e81c1bfbdc715f903d387b45b5da402e694de0f7f7a2d942ac2229
- SSDEEP 196608:uquFIF0wuPlCKrjQquFIF0wuPlCK8quFIF0wuPlCKrjinHh6ImzD+F:PoUm1oUqoUm7
- TLSH T1CE27AE01B6D68071E56315314966922E5639B9158B338ECFB38C1EAEFFB1AC14E36733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
AutoIT Executable
AutoIT scripts compiled to PE executables.