General
- Target 2026-06-29_e748bd072c18fcdbd3f26b1f0075b3c4_agent-tesla_amadey_blankgrabber_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop
- Size 12.4MB
- Sample260630-cgh7wacv21
- SHA256 f06f9d13a57a8b89a3bda3de448d902a032bce0bce979285c4aaae980bd7a7ca
- MD5 e748bd072c18fcdbd3f26b1f0075b3c4
- SHA1 7fec80e5ff1c6ccff0a330bb85943c60f6d0237b
- SHA512 c215385539cb360c32adf1e22b1437058a118c25c74c30a2ee6b9cc1a2c150d15dac9b7577819e59ac6de28a777ae9896dbc588174e1dca8c9bdc4d5fcf59418
- SSDEEP 98304:bA2KRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xFKRuy5a/OU/jIEeQfoR/IuOFB:s2quFIF0wuPlCK8quFIF0wuPlCKrjRcu
- TLSH T10ED69D0272D89475F5B312318A7592695639BC658B33C98F338C2D9EAFB16C09E39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-29_e748bd072c18fcdbd3f26b1f0075b3c4_agent-tesla_amadey_blankgrabber_cobalt-strike_darkgate_g.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-29_e748bd072c18fcdbd3f26b1f0075b3c4_agent-tesla_amadey_blankgrabber_cobalt-strike_darkgate_g.exe
Resource
win11ltsc2024-20260629-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-29_e748bd072c18fcdbd3f26b1f0075b3c4_agent-tesla_amadey_blankgrabber_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop
- Size 12.4MB
- SHA256 f06f9d13a57a8b89a3bda3de448d902a032bce0bce979285c4aaae980bd7a7ca
- MD5 e748bd072c18fcdbd3f26b1f0075b3c4
- SHA1 7fec80e5ff1c6ccff0a330bb85943c60f6d0237b
- SHA512 c215385539cb360c32adf1e22b1437058a118c25c74c30a2ee6b9cc1a2c150d15dac9b7577819e59ac6de28a777ae9896dbc588174e1dca8c9bdc4d5fcf59418
- SSDEEP 98304:bA2KRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xFKRuy5a/OU/jIEeQfoR/IuOFB:s2quFIF0wuPlCK8quFIF0wuPlCKrjRcu
- TLSH T10ED69D0272D89475F5B312318A7592695639BC658B33C98F338C2D9EAFB16C09E39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.