8a1e810a5915114cacda2c89ea6012aa59f39cc7a3970877ff402854cd45022e

General

Target
2026-06-25_b8e52bece45d37b5e310ccc1c665e789_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader
Size 14.2MB
Sample260629-yzy7psev5v
SHA256 8a1e810a5915114cacda2c89ea6012aa59f39cc7a3970877ff402854cd45022e
MD5 b8e52bece45d37b5e310ccc1c665e789
SHA1 967f57aa5ab89a2e77e14a59493fe2162555b8f1
SHA512 41599e7824f7385f82db74f1f3315fb1710b1dc9802c56cca077e2684f72fc636a78dca994b379ce56f8177f80477a37933b33b38258736db7c22c3b1f96c2f4
SSDEEP 196608:equFIF0wuPlCK1nSm1IkquFIF0wuPlCK1nSm1IgKWQc0gEYnvL:/oUOioUOKcZEIv
TLSH
T128E69D1276D84035F5B316319A25921D5A79BCA5CA33CD5F32882DDEFFF1A808E29732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-25_b8e52bece45d37b5e310ccc1c665e789_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader
- Size 14.2MB
- SHA256 8a1e810a5915114cacda2c89ea6012aa59f39cc7a3970877ff402854cd45022e
- MD5 b8e52bece45d37b5e310ccc1c665e789
- SHA1 967f57aa5ab89a2e77e14a59493fe2162555b8f1
- SHA512 41599e7824f7385f82db74f1f3315fb1710b1dc9802c56cca077e2684f72fc636a78dca994b379ce56f8177f80477a37933b33b38258736db7c22c3b1f96c2f4
- SSDEEP 196608:equFIF0wuPlCK1nSm1IkquFIF0wuPlCK1nSm1IgKWQc0gEYnvL:/oUOioUOKcZEIv
- TLSH
  T128E69D1276D84035F5B316319A25921D5A79BCA5CA33CD5F32882DDEFFF1A808E29732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

ransomware adware persistence spyware stealer
- Detects executables manipulated with Fody
- UPX dump on OEP (original entry point)
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2