7129205ab1bdde33f1b85fb72cee237a4918df00d60f2f0d53c3b212de8d9d52

General

Target
2026-06-27_4ea31f16f8ce07fbd076aaf22d609c02_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_vidar
Size 8.6MB
Sample260629-jebtcags5w
SHA256 7129205ab1bdde33f1b85fb72cee237a4918df00d60f2f0d53c3b212de8d9d52
MD5 4ea31f16f8ce07fbd076aaf22d609c02
SHA1 cda7803da903fc08b145873387bfb5180a3dccf5
SHA512 4f9aac605f2d4546c45610f3b24e5dfb7a97cd0332a6cdd76aa174d8456c77413b4490eecec687b52d016bee846c8f55d3595a11ee8fef3eb832f318fc8845b7
SSDEEP 98304:+OU/jIEeQfoR/IuOFVjUu55K2cPK8xwhyl7pXKsW1+M5NHyOhA:+FIF0wuPlCKbhy31yHyOe
TLSH
T153966B0177D858B5F5B312318A7582549A76BC614B32CACF33883A5E6F726C1AE35B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-27_4ea31f16f8ce07fbd076aaf22d609c02_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_vidar
- Size 8.6MB
- SHA256 7129205ab1bdde33f1b85fb72cee237a4918df00d60f2f0d53c3b212de8d9d52
- MD5 4ea31f16f8ce07fbd076aaf22d609c02
- SHA1 cda7803da903fc08b145873387bfb5180a3dccf5
- SHA512 4f9aac605f2d4546c45610f3b24e5dfb7a97cd0332a6cdd76aa174d8456c77413b4490eecec687b52d016bee846c8f55d3595a11ee8fef3eb832f318fc8845b7
- SSDEEP 98304:+OU/jIEeQfoR/IuOFVjUu55K2cPK8xwhyl7pXKsW1+M5NHyOhA:+FIF0wuPlCKbhy31yHyOe
- TLSH
  T153966B0177D858B5F5B312318A7582549A76BC614B32CACF33883A5E6F726C1AE35B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

ransomware spyware stealer adware persistence
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2