General
- Target 2026-05-02_108027122becfb753866c07dc041d63e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_icedid_njrat_poet-rat_remcos_satacom_stop_vidar
- Size 44.6MB
- Sample260502-m3tkvadv2s
- SHA256 c645e72a1cc91e9e0dfc2694b9d4db72aefad1073c370a68f8af29ce4b4e5ef3
- MD5 108027122becfb753866c07dc041d63e
- SHA1 4f4eeccfa0ea3d48037a617cec0e8753f99ec8e5
- SHA512 c5f7e38ebe078fb9229e21dda65f4d85781150272d837bcc4b60e6787321bcfc5437315c975b6f0b2df0ac37dcced1ca08cf4307535055eadb68aa99212b82db
- SSDEEP 196608:4CK2CKGsHh6ImzD+FmCK2CKGsHh6ImzD+F/SCK2CKGsHh6ImzD+FmCK2CKGsHh6z:bkHEkHYkHEkHXmHN6+Jrvc
- TLSH T1BCA79D11EAE750FAEA4785308967922BE731BC064331D7CFD3545EA6AE736D01E3A312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-02_108027122becfb753866c07dc041d63e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-02_108027122becfb753866c07dc041d63e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-02_108027122becfb753866c07dc041d63e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_icedid_njrat_poet-rat_remcos_satacom_stop_vidar
- Size 44.6MB
- SHA256 c645e72a1cc91e9e0dfc2694b9d4db72aefad1073c370a68f8af29ce4b4e5ef3
- MD5 108027122becfb753866c07dc041d63e
- SHA1 4f4eeccfa0ea3d48037a617cec0e8753f99ec8e5
- SHA512 c5f7e38ebe078fb9229e21dda65f4d85781150272d837bcc4b60e6787321bcfc5437315c975b6f0b2df0ac37dcced1ca08cf4307535055eadb68aa99212b82db
- SSDEEP 196608:4CK2CKGsHh6ImzD+FmCK2CKGsHh6ImzD+F/SCK2CKGsHh6ImzD+FmCK2CKGsHh6z:bkHEkHYkHEkHXmHN6+Jrvc
- TLSH T1BCA79D11EAE750FAEA4785308967922BE731BC064331D7CFD3545EA6AE736D01E3A312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.