General
- Target 2026-04-25_73a0863c79b4751cca79c5a1c1a1cc08_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_poet-rat_redline-stealer_remcos_rhadamanthys_satacom_stealc_stop_vidar
- Size 20.4MB
- Sample260425-megldae15v
- SHA256 743f843dac61fa55c71c4e809a0da8499a3865e2c9498949233382e3deaecf8c
- MD5 73a0863c79b4751cca79c5a1c1a1cc08
- SHA1 8103c60ab19e1a061a3d9e3225be3ea17a693897
- SHA512 7d373fffffd906539f3e29afd9b1c509c8d262fd4d883fd8b6e429162d72ea8fce1d1168a1887bdf1137d611d4b2966a496f564acee73fd0ad58173fbb530db4
- SSDEEP 196608:2C+CX7mlCKbCX7mlCKyC+CX7mlCKtmHpn6F44IAWvh1yJHh6ImzD+F:2rQSQ7rQAmHN6+JrvXyE
- TLSH T167278D10A2E750F9E1AB91314976933AD6317C1247328B8F52A89E9EBFB36D01D35733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-25_73a0863c79b4751cca79c5a1c1a1cc08_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-25_73a0863c79b4751cca79c5a1c1a1cc08_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-25_73a0863c79b4751cca79c5a1c1a1cc08_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_poet-rat_redline-stealer_remcos_rhadamanthys_satacom_stealc_stop_vidar
- Size 20.4MB
- SHA256 743f843dac61fa55c71c4e809a0da8499a3865e2c9498949233382e3deaecf8c
- MD5 73a0863c79b4751cca79c5a1c1a1cc08
- SHA1 8103c60ab19e1a061a3d9e3225be3ea17a693897
- SHA512 7d373fffffd906539f3e29afd9b1c509c8d262fd4d883fd8b6e429162d72ea8fce1d1168a1887bdf1137d611d4b2966a496f564acee73fd0ad58173fbb530db4
- SSDEEP 196608:2C+CX7mlCKbCX7mlCKyC+CX7mlCKtmHpn6F44IAWvh1yJHh6ImzD+F:2rQSQ7rQAmHN6+JrvXyE
- TLSH T167278D10A2E750F9E1AB91314976933AD6317C1247328B8F52A89E9EBFB36D01D35733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
AutoIT Executable
AutoIT scripts compiled to PE executables.