2026-06-30_5a78202f6ac1364ef389d72b741a2b0d_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_5a78202f6ac1364ef389d72b741a2b0d_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_wannacry
Size 7.3MB
Sample260630-2a95fsax21
SHA256 1cecc78cc12a283bfbbd5e5b44d883202b9d8ed5fcb3e9973df3706bb10cd133
MD5 5a78202f6ac1364ef389d72b741a2b0d
SHA1 c803a0758f6fe137e83f886ae1c0678a9ffe15f7
SHA512 ba964c90ba4c4f072c66e03db4b4cda92eb724eb4545ee449e695ea7c287f001ba6e34ef2f9ec6ecea5e6a7f32c94e6feb9d382e2b36b40ec1b47d5bc35784e3
SSDEEP 98304:/KRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUxS7PL8SERbD:/quFIF0wuPlCKrjRvqz
TLSH
T1DE76AE1277D44035F5B316318A3592695A7ABC658F33CA8F338C2DAE6F716808A39737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_5a78202f6ac1364ef389d72b741a2b0d_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_wannacry

File Explorer

2026-06-30_5a78202f6ac1364ef389d72b741a2b0d_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_wannacry

.exe 7.3MB

2026-06-30_5a78202f6ac1364ef389d72b741a2b0d_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_wannacry

IMPHASH 89ad82854409b9dd81837c899d65f03e
SHA256 1cecc78cc12a283bfbbd5e5b44d883202b9d8ed5fcb3e9973df3706bb10cd133
MD5 5a78202f6ac1364ef389d72b741a2b0d
SHA1 c803a0758f6fe137e83f886ae1c0678a9ffe15f7
SHA512 ba964c90ba4c4f072c66e03db4b4cda92eb724eb4545ee449e695ea7c287f001ba6e34ef2f9ec6ecea5e6a7f32c94e6feb9d382e2b36b40ec1b47d5bc35784e3
SSDEEP 98304:/KRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUxS7PL8SERbD:/quFIF0wuPlCKrjRvqz
TLSH
T1DE76AE1277D44035F5B316318A3592695A7ABC658F33CA8F338C2DAE6F716808A39737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27871

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoInitialize CoCreateInstance CoUninitialize

comctl32

PropertySheetA CreatePropertySheetPageA

kernel32

LocalFree FormatMessageA FreeLibrary GetModuleHandleA GetVersionExA DeleteFileA GetPrivateProfileIntA GetPrivateProfileStringA ResumeThread SetPriorityClass GetCurrentProcess GetCurrentThread MultiByteToWideChar CreateProcessA GetModuleFileNameA RemoveDirectoryA GetFileSize GetTempFileNameA GetTempPathA LoadLibraryA GetProcAddress GetFileAttributesA GetStartupInfoA SetLastError MapViewOfFile CreateDirectoryA lstrlenA UnmapViewOfFile CreateFileA GetLastError DosDateTimeToFileTime SetFileTime CloseHandle CreateFileMappingA SetThreadPriority

user32

RegisterClassA CreateWindowExA ShowWindow UpdateWindow LoadCursorA SetCursor PeekMessageA TranslateMessage DispatchMessageA GetDlgItem GetWindowRect MoveWindow GetDC ReleaseDC SendDlgItemMessageA GetParent wsprintfA SetDlgItemTextA PostMessageA DefWindowProcA BeginPaint GetSystemMetrics EndPaint SendMessageA GetFocus MessageBoxA

gdi32

SelectObject TextOutA CreateDIBitmap CreateSolidBrush SetTextColor CreateFontA SetBkMode DeleteObject

advapi32

RegCloseKey RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegSetValueExA RegQueryValueA RegEnumKeyExA RegQueryValueExA RegOpenKeyExA

shell32

ShellExecuteA

msvcrt

_acmdln exit _XcptFilter _exit __p___argc __p___argv strncmp fgets realloc qsort __mb_cur_max __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 _open _controlfp _strcmpi _strdup _tempnam _close _read _strnicmp _isctype _pctype strchr memcpy memset strncat strcat strlen strcpy strcmp strrchr fprintf _vsnprintf malloc _snprintf strncpy free sscanf _putenv remove fread ftell fseek fopen fclose fflush freopen _iob fwrite strftime localtime time sprintf _fstat strtol

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_5a78202f6ac1364ef389d72b741a2b0d_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_wannacry

ole32

comctl32

kernel32

user32

gdi32

advapi32

shell32

msvcrt

generic