371aedccd5597a244718c933e415df377c61a8f9ca00d00932aaec7413b60814

General

Target
2026-06-27_af3e135e744c8b3313568756706b43f9_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_vidar
Size 23.8MB
Sample260629-efv66adx7m
SHA256 371aedccd5597a244718c933e415df377c61a8f9ca00d00932aaec7413b60814
MD5 af3e135e744c8b3313568756706b43f9
SHA1 c6e1936f9e0f4c530f3ffc409582da67873ab16d
SHA512 422bee923ab8c2455bc41d3dcc41a1117eee78353b44a455380ec33272c75559fa1937252446237dde83ca4ae9e00ae0ed52f523e60a669b2dd640ea7b2adbb0
SSDEEP 196608:gFIF0wuPlCKbhy31yHyObFIF0wuPlCKbhyGFIF0wuPlCKbhy31yHyOB1yn:KUIylyHnUIyQUIylyHDyn
TLSH
T1BC477B1177E85475F5B312318A7582549A76BC618F32CACF32883A5E6F726C0AE35B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-27_af3e135e744c8b3313568756706b43f9_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_vidar
- Size 23.8MB
- SHA256 371aedccd5597a244718c933e415df377c61a8f9ca00d00932aaec7413b60814
- MD5 af3e135e744c8b3313568756706b43f9
- SHA1 c6e1936f9e0f4c530f3ffc409582da67873ab16d
- SHA512 422bee923ab8c2455bc41d3dcc41a1117eee78353b44a455380ec33272c75559fa1937252446237dde83ca4ae9e00ae0ed52f523e60a669b2dd640ea7b2adbb0
- SSDEEP 196608:gFIF0wuPlCKbhy31yHyObFIF0wuPlCKbhyGFIF0wuPlCKbhy31yHyOB1yn:KUIylyHnUIyQUIylyHDyn
- TLSH
  T1BC477B1177E85475F5B312318A7582549A76BC618F32CACF32883A5E6F726C0AE35B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

ransomware spyware stealer adware persistence
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2