d4ec6e9dfdbe0a5ebd31769dc7b09513f7ec8b7b161c5141fcff4a175ff52a10

General

Target
2026-06-29_e3ff3b3fb47602a4738ccf1d0068a959_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_rugmi_satacom_smoke-loader_stealc_stop_wannacry
Size 7.7MB
Sample260630-cmvsvsdt5m
SHA256 d4ec6e9dfdbe0a5ebd31769dc7b09513f7ec8b7b161c5141fcff4a175ff52a10
MD5 e3ff3b3fb47602a4738ccf1d0068a959
SHA1 43023e596515207184d692314e5a3b81155f29de
SHA512 93dab9dfc3ea45c78f1061082eda5a471f16ecdfde296405fa489d0ebb1510bd796446fbf445e6690504206d063639644fa674da470c8cc77be1ec5b895c8ed8
SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TULkSERbPRW4rRjY:equFIF0wuPlCKrjRGtrRj
TLSH
T1B386AE1276D44035F5B31632993892246A7DBC659F32CA9F338C2D6E7FB05809A3A737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-29_e3ff3b3fb47602a4738ccf1d0068a959_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_rugmi_satacom_smoke-loader_stealc_stop_wannacry
- Size 7.7MB
- SHA256 d4ec6e9dfdbe0a5ebd31769dc7b09513f7ec8b7b161c5141fcff4a175ff52a10
- MD5 e3ff3b3fb47602a4738ccf1d0068a959
- SHA1 43023e596515207184d692314e5a3b81155f29de
- SHA512 93dab9dfc3ea45c78f1061082eda5a471f16ecdfde296405fa489d0ebb1510bd796446fbf445e6690504206d063639644fa674da470c8cc77be1ec5b895c8ed8
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TULkSERbPRW4rRjY:equFIF0wuPlCKrjRGtrRj
- TLSH
  T1B386AE1276D44035F5B31632993892246A7DBC659F32CA9F338C2D6E7FB05809A3A737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

ransomware spyware stealer adware persistence
- Detects executables manipulated with Fody
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2