General
- Target 2026-06-28_9e522ccf4b3937fba1c1581b268331a1_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_satacom_smoke-loader
- Size 7.6MB
- Sample260628-y2wvcsd15r
- SHA256 6a55d5950df6e59b6c102bfe31d0441f0cda19b1caecbd8a031b026d883d0527
- MD5 9e522ccf4b3937fba1c1581b268331a1
- SHA1 051e82db2c0a35889e3aa299afc47352467347ab
- SHA512 35b5d7529893d7fd77a9500b84b8b476456e93dd340b6746771c6c8976ea3837df6ce6a82ec38bffde2b2157fdaa8143726b4c61518181765bd628e2de1d4109
- SSDEEP 98304:QKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUApLZ1opDbSVHrjN:QquFIF0wuPlCKrjR2LZ7pjN
- TLSH T14586AE1273D84075F5B316319A3592646A39BCA58F32CA9F33883D5E7FB16809A36733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-28_9e522ccf4b3937fba1c1581b268331a1_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_9e522ccf4b3937fba1c1581b268331a1_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win11ltsc2024-20260618-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-28_9e522ccf4b3937fba1c1581b268331a1_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_satacom_smoke-loader
- Size 7.6MB
- SHA256 6a55d5950df6e59b6c102bfe31d0441f0cda19b1caecbd8a031b026d883d0527
- MD5 9e522ccf4b3937fba1c1581b268331a1
- SHA1 051e82db2c0a35889e3aa299afc47352467347ab
- SHA512 35b5d7529893d7fd77a9500b84b8b476456e93dd340b6746771c6c8976ea3837df6ce6a82ec38bffde2b2157fdaa8143726b4c61518181765bd628e2de1d4109
- SSDEEP 98304:QKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUApLZ1opDbSVHrjN:QquFIF0wuPlCKrjR2LZ7pjN
- TLSH T14586AE1273D84075F5B316319A3592646A39BCA58F32CA9F33883D5E7FB16809A36733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.