General
- Target 2026-04-25_7c793e4976b8ceac034b5b92b31a395c_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_icedid_poet-rat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_vidar
- Size 20.2MB
- Sample260425-cfvvaaby4y
- SHA256 7f5e7fe9a2f9cc04c2d4de30bd450036a2c7a5893d29fbcc1cd60b813661c7c9
- MD5 7c793e4976b8ceac034b5b92b31a395c
- SHA1 531d313f56b0238235344b57eab06547dedad44c
- SHA512 da3a0fccff1043afa06b9b62d5549a3af3a96ef8f68218f04b89ff0bc01c05396787bddac92bcf3fe139df112b7a7e7e471a2a7c3691ff4c5aa84837e9c1611f
- SSDEEP 196608:2CX7mlCKyC+CX7mlCK0Hh6ImzD+FWCX7mlCKyC+CX7mlCK0Hh6ImzD+FrP:2Q7rQAvQ7rQA
- TLSH T153279D10FBE68471F65305314A66A22F1635B9158736CECBD2841EEEFEB26D11A36333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-25_7c793e4976b8ceac034b5b92b31a395c_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-25_7c793e4976b8ceac034b5b92b31a395c_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-25_7c793e4976b8ceac034b5b92b31a395c_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_icedid_poet-rat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_vidar
- Size 20.2MB
- SHA256 7f5e7fe9a2f9cc04c2d4de30bd450036a2c7a5893d29fbcc1cd60b813661c7c9
- MD5 7c793e4976b8ceac034b5b92b31a395c
- SHA1 531d313f56b0238235344b57eab06547dedad44c
- SHA512 da3a0fccff1043afa06b9b62d5549a3af3a96ef8f68218f04b89ff0bc01c05396787bddac92bcf3fe139df112b7a7e7e471a2a7c3691ff4c5aa84837e9c1611f
- SSDEEP 196608:2CX7mlCKyC+CX7mlCK0Hh6ImzD+FWCX7mlCKyC+CX7mlCK0Hh6ImzD+FrP:2Q7rQAvQ7rQA
- TLSH T153279D10FBE68471F65305314A66A22F1635B9158736CECBD2841EEEFEB26D11A36333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
AutoIT Executable
AutoIT scripts compiled to PE executables.