Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
09/05/2026, 09:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-09_13257376994dde796007267e7ffa9581_agent-tesla_amadey_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-09_13257376994dde796007267e7ffa9581_agent-tesla_amadey_icedid_njrat_vidar.exe
Resource
win11-20260130-en
2 signatures
150 seconds
General
- Target 2026-05-09_13257376994dde796007267e7ffa9581_agent-tesla_amadey_icedid_njrat_vidar.exe
- Size 2.0MB
- Sample260509-llb4ssd181
- SHA256 a4a10373f79c73588e058498038c18118114da16f235a1a175cf5e6397fc005d
- MD5 13257376994dde796007267e7ffa9581
- SHA1 094a5fd1c9aa99cbc56c525036d3b1a98b6b290e
- SHA512 a4ee8c8dab6c22277e91fd89675bf91a6fd90950960f30ad2b982dad8dfb5aaef07597a5f4bf8e7b8630ad968a147091d49d6d1c57d19ad7c3b4e9112d14440c
- SSDEEP 49152:k2EYTb8atv1orq+pEiSDTj1VyveZlHeqtaQPha7YqrU4u6tBvALfuG9:pXbIrqbtFYcqrUF6tBvAju
- TLSH T1F0A5D01973A4429DFEABE176CA13C607D7B1B84A0277861F01E46B766F337711A2E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3044-0-0x00007FF7BAE10000-0x00007FF7BB01B000-memory.dmp autoit_exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3044 2026-05-09_13257376994dde796007267e7ffa9581_agent-tesla_amadey_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-09_13257376994dde796007267e7ffa9581_agent-tesla_amadey_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-09_13257376994dde796007267e7ffa9581_agent-tesla_amadey_icedid_njrat_vidar.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3044
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\config.ini
- Size 11KB
- SHA256 e5cd1e2ca31e149c2950fe40a185c4e9737dae31be06fbc663fd18b742c04ffe
- MD5 42d890d4352b6d57e2d98341190d061d
- SHA1 f979c9a097300a1f30d4dab902317b3ede7e3807
- SHA512 81bb456b36894c2dea7089ca44db5faa4bc640f5cc1be220c2dbe30075f2c865b3c86d11ea00a94636d3cfcfcf80d0c5d5021fc9487f06c596795e186f8adf1a
- SSDEEP 192:bGCcM5+Kzp0ecdFuCvcf/vcgBQENVBotrcabq2ctKlmm8hJIel:boM5+Ep0ecdQCvc3vcgxNLaO2ctKMm8p
- TLSH T18132CA05C6D346B3CAA57E4E33717E93273BF2CC85CE1351DB56813E2AD2408929BE59
- MD5 SHA1 SHA512 SSDEEP TLSH