General
- Target 2026-04-25_6da5d35360f7a5119a42f27cf4b5f6ae_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_vidar
- Size 22.1MB
- Sample260425-mcph7sbx2p
- SHA256 f35a13c27e648ea9c9ee454c36f1c0c61d5ed06f950d9d9e14e7d10cb137989d
- MD5 6da5d35360f7a5119a42f27cf4b5f6ae
- SHA1 1af461d70771bd64874e6ff00a9c51d3d2c66434
- SHA512 d4f52691e4f54e25b85ea61c604da96abb0f5a16fee0ab92d6422d9822d0c207903056438d37611796e353c54f54b75bf330de9b7679762461ceb291ca8df062
- SSDEEP 393216:v/3574mHN6+Jrv4/C/3577/C/3574mHN6+JrvXyGq:n5VbrJ5U5VbrPnq
- TLSH T1C1376B6162E760EDE5BBD1358A758331EA727C130631838F127CD65A2F73690AE39723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-25_6da5d35360f7a5119a42f27cf4b5f6ae_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_glass.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-25_6da5d35360f7a5119a42f27cf4b5f6ae_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_glass.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-25_6da5d35360f7a5119a42f27cf4b5f6ae_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_vidar
- Size 22.1MB
- SHA256 f35a13c27e648ea9c9ee454c36f1c0c61d5ed06f950d9d9e14e7d10cb137989d
- MD5 6da5d35360f7a5119a42f27cf4b5f6ae
- SHA1 1af461d70771bd64874e6ff00a9c51d3d2c66434
- SHA512 d4f52691e4f54e25b85ea61c604da96abb0f5a16fee0ab92d6422d9822d0c207903056438d37611796e353c54f54b75bf330de9b7679762461ceb291ca8df062
- SSDEEP 393216:v/3574mHN6+Jrv4/C/3577/C/3574mHN6+JrvXyGq:n5VbrJ5U5VbrPnq
- TLSH T1C1376B6162E760EDE5BBD1358A758331EA727C130631838F127CD65A2F73690AE39723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
AutoIT Executable
AutoIT scripts compiled to PE executables.