General
- Target 2026-05-01_0e6f087ffb21f670b186aacc42b018a8_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_poet-rat_remcos_satacom_smoke-loader_stealc_stop_vidar
- Size 19.8MB
- Sample260501-skshqact7j
- SHA256 a7dd5cb8abdde21232f296a9b8c471d818aa47d356b63ea5d28d5a7f538e3086
- MD5 0e6f087ffb21f670b186aacc42b018a8
- SHA1 c69a11c413ffeb5a133e694ed843cf1e2c7e9bf1
- SHA512 49b885a8eb35a5de3ee4bee79fc0ef37a53e9c9b58183734f29a6cef89e7b2677cfb4edc6ec09f9c38db1d0cd91b2ef7f4ffba0bfcf29267494ceb44578cba53
- SSDEEP 196608:f3KWQc0gEYnvLhCKIujMb3KWQc0gEYnvLhCKIujMLv1yJHh6ImzD+F:GcZEIvUEXcZEIvUEetyE
- TLSH T1FD27AE01B7E68071E57346314976926A96367C158F32CBCF93801EAEBFB26D09A35733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-01_0e6f087ffb21f670b186aacc42b018a8_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-01_0e6f087ffb21f670b186aacc42b018a8_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-01_0e6f087ffb21f670b186aacc42b018a8_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_poet-rat_remcos_satacom_smoke-loader_stealc_stop_vidar
- Size 19.8MB
- SHA256 a7dd5cb8abdde21232f296a9b8c471d818aa47d356b63ea5d28d5a7f538e3086
- MD5 0e6f087ffb21f670b186aacc42b018a8
- SHA1 c69a11c413ffeb5a133e694ed843cf1e2c7e9bf1
- SHA512 49b885a8eb35a5de3ee4bee79fc0ef37a53e9c9b58183734f29a6cef89e7b2677cfb4edc6ec09f9c38db1d0cd91b2ef7f4ffba0bfcf29267494ceb44578cba53
- SSDEEP 196608:f3KWQc0gEYnvLhCKIujMb3KWQc0gEYnvLhCKIujMLv1yJHh6ImzD+F:GcZEIvUEXcZEIvUEetyE
- TLSH T1FD27AE01B7E68071E57346314976926A96367C158F32CBCF93801EAEBFB26D09A35733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.