General
- Target 2026-06-05_f43f99325ea66d6cf4984ab28e2911e8_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_vidar_wannacry
- Size 23.7MB
- Sample260605-ya2ljac19x
- SHA256 1e8e456273d6c223a295599f07b8bc3bcb97ed176723fd33503c51d0368c500d
- MD5 f43f99325ea66d6cf4984ab28e2911e8
- SHA1 b3f543fb98eef42666c72e7177150c004f39b554
- SHA512 a5e4df515712fd910c2483055673eb124646abc225c4793bb6f2653522cbee00d3083b921c802b73777cdbc01c260b65579ddb98abbde9b0c4d08716d5d2bfd2
- SSDEEP 196608:8FIF0wuPlCKbhyjFIF0wuPlCKbhyjFIF0wuPlCKbhyjFIF0wuPlCKbhyc:eUIyzUIyzUIyzUIyc
- TLSH T102478D12B7D484B2F5B34231896582199771BC5587338ACF339C6A9E6F736D08E39B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-05_f43f99325ea66d6cf4984ab28e2911e8_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-05_f43f99325ea66d6cf4984ab28e2911e8_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win11-20260513-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-05_f43f99325ea66d6cf4984ab28e2911e8_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_vidar_wannacry
- Size 23.7MB
- SHA256 1e8e456273d6c223a295599f07b8bc3bcb97ed176723fd33503c51d0368c500d
- MD5 f43f99325ea66d6cf4984ab28e2911e8
- SHA1 b3f543fb98eef42666c72e7177150c004f39b554
- SHA512 a5e4df515712fd910c2483055673eb124646abc225c4793bb6f2653522cbee00d3083b921c802b73777cdbc01c260b65579ddb98abbde9b0c4d08716d5d2bfd2
- SSDEEP 196608:8FIF0wuPlCKbhyjFIF0wuPlCKbhyjFIF0wuPlCKbhyjFIF0wuPlCKbhyc:eUIyzUIyzUIyzUIyc
- TLSH T102478D12B7D484B2F5B34231896582199771BC5587338ACF339C6A9E6F736D08E39B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.