General
- Target 2026-06-28_d9ea004998e2dfaf9668a2e4a97680ba_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_satacom_smoke-loader_vidar
- Size 7.7MB
- Sample260628-xbpgxsct2l
- SHA256 a5501b61b4b1a957a6221af5392cbd3b7efa0cf5a5b4ec730aa90237f01dfc0c
- MD5 d9ea004998e2dfaf9668a2e4a97680ba
- SHA1 902b6a218f36f794844618533bb8a198fcc99ebf
- SHA512 4d17eb2745fc2a260616df9d61f297f4e2133eebd42eba3515b083b218a6cf57bbf6e2225c1edaa5abd9a882b1b7ae8edeee661630ec37b23a63b4f4cd981cb1
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUAgBOLZ1opDbSVHrjK:equFIF0wuPlCKrjR38LZ7pjK
- TLSH T1AA86AE1273D85475F5B31631993492246A39BCA58F32CA9F33C82D5E7FB16809A3A733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-28_d9ea004998e2dfaf9668a2e4a97680ba_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_d9ea004998e2dfaf9668a2e4a97680ba_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win11ltsc2024-20260618-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-28_d9ea004998e2dfaf9668a2e4a97680ba_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_satacom_smoke-loader_vidar
- Size 7.7MB
- SHA256 a5501b61b4b1a957a6221af5392cbd3b7efa0cf5a5b4ec730aa90237f01dfc0c
- MD5 d9ea004998e2dfaf9668a2e4a97680ba
- SHA1 902b6a218f36f794844618533bb8a198fcc99ebf
- SHA512 4d17eb2745fc2a260616df9d61f297f4e2133eebd42eba3515b083b218a6cf57bbf6e2225c1edaa5abd9a882b1b7ae8edeee661630ec37b23a63b4f4cd981cb1
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUAgBOLZ1opDbSVHrjK:equFIF0wuPlCKrjR38LZ7pjK
- TLSH T1AA86AE1273D85475F5B31631993492246A39BCA58F32CA9F33C82D5E7FB16809A3A733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.