2026-06-28_3ca04547fb9c69e834429e2192873ab5_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee_vidar

General

Target
2026-06-28_3ca04547fb9c69e834429e2192873ab5_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee_vidar
Size 16.4MB
Sample260628-27f8msf19z
SHA256 68766e23093116c2f4304bb3623eef599366f173a892450ab948c77b9f48f65d
MD5 3ca04547fb9c69e834429e2192873ab5
SHA1 ce24d3480aecd013d09f3a8c0d4f4b60bb4ad0b5
SHA512 d3bc8f956456d6eab69acf7b56b645033c49e4f80736eaef0dc8314815eea4634aa413a7872f95727ce037b7818814a85b6834c9855fdc67b683b3a7b2d9b497
SSDEEP 196608:WmxSquFIF0wuPlCKrjRdmxSquFIF0wuPlCKrjRdmx:WmoUmvmoUmv
TLSH
T10A07AF1273D85475F1B31231893596559A7ABCA58F32CA8F33882D6E6F716C08E3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_3ca04547fb9c69e834429e2192873ab5_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee_vidar

File Explorer

2026-06-28_3ca04547fb9c69e834429e2192873ab5_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee_vidar

.exe 16.4MB

2026-06-28_3ca04547fb9c69e834429e2192873ab5_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee_vidar

IMPHASH 0a6e6a1e3cba00906d9b8fea0b706cf9
SHA256 68766e23093116c2f4304bb3623eef599366f173a892450ab948c77b9f48f65d
MD5 3ca04547fb9c69e834429e2192873ab5
SHA1 ce24d3480aecd013d09f3a8c0d4f4b60bb4ad0b5
SHA512 d3bc8f956456d6eab69acf7b56b645033c49e4f80736eaef0dc8314815eea4634aa413a7872f95727ce037b7818814a85b6834c9855fdc67b683b3a7b2d9b497
SSDEEP 196608:WmxSquFIF0wuPlCKrjRdmxSquFIF0wuPlCKrjRdmx:WmoUmvmoUmv
TLSH
T10A07AF1273D85475F1B31231893596559A7ABCA58F32CA8F33882D6E6F716C08E3A733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects executables manipulated with Fody
AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12803

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\t32.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject CreateProcessW GetCurrentProcess WaitForSingleObject GenerateConsoleCtrlEvent AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar CreateJobObjectA GetStdHandle GetLastError SetConsoleCtrlHandler DuplicateHandle CloseHandle HeapSize GetProcessHeap SetEndOfFile SetEnvironmentVariableW HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetStringTypeW GetCommandLineA HeapSetInformation TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InitializeCriticalSectionAndSpinCount EncodePointer DecodePointer RtlUnwind HeapCreate GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress WriteFile SetHandleCount GetFileType GetStartupInfoW DeleteCriticalSection Sleep LCMapStringW ReadFile SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime CreateFileW LoadLibraryW HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle IsProcessorFeaturePresent CompareStringW WriteConsoleW

shlwapi

StrStrIW PathRemoveFileSpecW PathCombineW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_3ca04547fb9c69e834429e2192873ab5_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee_vidar

kernel32

shlwapi

generic