2026-06-28_135b75c2da36170150596ecfa526533a_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_tofsee

General

Target
2026-06-28_135b75c2da36170150596ecfa526533a_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_tofsee
Size 7.2MB
Sample260629-am3glaat2m
SHA256 5f8c206ab507f49e1f2911cc1096aefad9722ddb34af04a4c77914f1d789a447
MD5 135b75c2da36170150596ecfa526533a
SHA1 0e5b7ad910b12537d303cd0c7d1c31d079c1cc0d
SHA512 21c9986875b896876206f39004dd6a297938d5a43136ac7f63e8626f624360d9a6c93f8de1101206896bc57806306a72526d4abbaca127a97c02989bfdc6c400
SSDEEP 98304:GKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUx3nY:GquFIF0wuPlCKrjRv3Y
TLSH
T1E476AE0273D85475F1B3163199759229567ABCA58E32CA8F328C3D5E6FB16C08E3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_135b75c2da36170150596ecfa526533a_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_tofsee

File Explorer

2026-06-28_135b75c2da36170150596ecfa526533a_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_tofsee

.exe 7.2MB

2026-06-28_135b75c2da36170150596ecfa526533a_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_tofsee

IMPHASH ad2258898f0fbdcaaa6098836dd9129f
SHA256 5f8c206ab507f49e1f2911cc1096aefad9722ddb34af04a4c77914f1d789a447
MD5 135b75c2da36170150596ecfa526533a
SHA1 0e5b7ad910b12537d303cd0c7d1c31d079c1cc0d
SHA512 21c9986875b896876206f39004dd6a297938d5a43136ac7f63e8626f624360d9a6c93f8de1101206896bc57806306a72526d4abbaca127a97c02989bfdc6c400
SSDEEP 98304:GKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUx3nY:GquFIF0wuPlCKrjRv3Y
TLSH
T1E476AE0273D85475F1B3163199759229567ABCA58E32CA8F328C3D5E6FB16C08E3A733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Detects executables manipulated with Fody
AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

17932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\w64.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject FreeLibrary CreateProcessW SetHandleInformation WaitForSingleObjectEx AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar GetStartupInfoW GetTempPathW CreateJobObjectA GetStdHandle GetLastError GetProcAddress SetStdHandle LoadLibraryA GetFileType SetConsoleCtrlHandler SetCurrentDirectoryW CloseHandle GetProcessHeap SetEndOfFile SetEnvironmentVariableW CompareStringW FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc GetModuleHandleW DecodePointer HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EncodePointer TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount GetCommandLineA RtlUnwindEx DeleteCriticalSection LoadLibraryW FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc WriteFile HeapSetInformation GetVersion HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount Sleep LCMapStringW ReadFile SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime CreateFileW HeapSize WriteConsoleW

user32

PostMessageW WaitForInputIdle PeekMessageW CreateWindowExW GetMessageW DestroyWindow

shlwapi

PathCombineW StrStrIW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_135b75c2da36170150596ecfa526533a_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_tofsee

kernel32

user32

shlwapi

generic