General
- Target 2026-06-26_d2d41ef93a4edd5bb6f89bf3f0967ed7_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stop
- Size 6.9MB
- Sample260629-n8nr8aev2k
- SHA256 07bde647def47ed06e8c3b25ad05ee4c33319b332ed5a4d5a6d10825bbf5172c
- MD5 d2d41ef93a4edd5bb6f89bf3f0967ed7
- SHA1 0167e3165cedfa35a35b1d2536cc74ad18baeb3a
- SHA512 dfb6f97ebad301fab360d4effb38334c1ba94add3eb7bb5a29bbe107b3a3a329bc413b6403311e9a998d928790835e8f6e96c6ca2507171914d5eabf319d44e0
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUlfNOhf:equFIF0wuPlCKrjRffNOJ
- TLSH T14C76AE0273D85475F5B316318A3592695A39BCA58E33C98F328C3D5E7BB06C1AA39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-26_d2d41ef93a4edd5bb6f89bf3f0967ed7_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_d2d41ef93a4edd5bb6f89bf3f0967ed7_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win11ltsc2024-20260629-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-26_d2d41ef93a4edd5bb6f89bf3f0967ed7_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stop
- Size 6.9MB
- SHA256 07bde647def47ed06e8c3b25ad05ee4c33319b332ed5a4d5a6d10825bbf5172c
- MD5 d2d41ef93a4edd5bb6f89bf3f0967ed7
- SHA1 0167e3165cedfa35a35b1d2536cc74ad18baeb3a
- SHA512 dfb6f97ebad301fab360d4effb38334c1ba94add3eb7bb5a29bbe107b3a3a329bc413b6403311e9a998d928790835e8f6e96c6ca2507171914d5eabf319d44e0
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUlfNOhf:equFIF0wuPlCKrjRffNOJ
- TLSH T14C76AE0273D85475F5B316318A3592695A39BCA58E33C98F328C3D5E7BB06C1AA39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.