2026-06-28_a78ea0470636e05096c02ec5f31b8ee1_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_tofsee_vidar

General

Target
2026-06-28_a78ea0470636e05096c02ec5f31b8ee1_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_tofsee_vidar
Size 16.3MB
Sample260628-yr29dsc16w
SHA256 17fbe7b9db6c4f6f7f8c2f6524ff7a259ebeb0ee0b1e1acb1b2c1c051b20eda0
MD5 a78ea0470636e05096c02ec5f31b8ee1
SHA1 ff93fde686fdd9390b95188615632ecd95c2969d
SHA512 548966325203de68eac4b9fb61d5dfa38e6c02f68715cdcb8f30c7b3cba5592716166d32525dedaf1693ab360bd14c3167e5e954cdfa22214e152f52e1f72382
SSDEEP 196608:xxSquFIF0wuPlCKrjRdmxSquFIF0wuPlCKrjRdmxs:7oUmvmoUmv
TLSH
T1B407BF1273D85475F1B3123189359655AA7ABCA58F32CA8F33882D5E6F716C08E3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_a78ea0470636e05096c02ec5f31b8ee1_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_tofsee_vidar

File Explorer

2026-06-28_a78ea0470636e05096c02ec5f31b8ee1_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_tofsee_vidar

.exe 16.3MB

2026-06-28_a78ea0470636e05096c02ec5f31b8ee1_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_tofsee_vidar

IMPHASH c51d659b4b1142d4af3795d09f1d63f7
SHA256 17fbe7b9db6c4f6f7f8c2f6524ff7a259ebeb0ee0b1e1acb1b2c1c051b20eda0
MD5 a78ea0470636e05096c02ec5f31b8ee1
SHA1 ff93fde686fdd9390b95188615632ecd95c2969d
SHA512 548966325203de68eac4b9fb61d5dfa38e6c02f68715cdcb8f30c7b3cba5592716166d32525dedaf1693ab360bd14c3167e5e954cdfa22214e152f52e1f72382
SSDEEP 196608:xxSquFIF0wuPlCKrjRdmxSquFIF0wuPlCKrjRdmxs:7oUmvmoUmv
TLSH
T1B407BF1273D85475F1B3123189359655AA7ABCA58F32CA8F33882D5E6F716C08E3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables manipulated with Fody
AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

17020

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\t64.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject CreateProcessW SetHandleInformation WaitForSingleObjectEx AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar GetStartupInfoW GetTempPathW CreateJobObjectA GetStdHandle GetLastError SetStdHandle GetFileType SetConsoleCtrlHandler SetCurrentDirectoryW CloseHandle HeapSize GetProcessHeap SetEndOfFile SetEnvironmentVariableW HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EncodePointer DecodePointer TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount GetCommandLineA RtlUnwindEx HeapSetInformation GetVersion HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc GetProcAddress GetModuleHandleW WriteFile SetHandleCount DeleteCriticalSection Sleep LCMapStringW ReadFile SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime CreateFileW LoadLibraryW HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers CompareStringW WriteConsoleW

shlwapi

StrStrIW PathRemoveFileSpecW PathCombineW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_a78ea0470636e05096c02ec5f31b8ee1_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_tofsee_vidar

kernel32

shlwapi

generic