General
- Target 2026-06-29_d7dce100c0a37b0f1559a52d483283db_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_vidar
- Size 7.7MB
- Sample260630-dc2n4ady4p
- SHA256 a0dc68db7015d7a5339326702445ae73cec568b69c9ca341e5e0440bb0ef2f39
- MD5 d7dce100c0a37b0f1559a52d483283db
- SHA1 1244596d12b496b6892cbd64672d49c9d41ff3ba
- SHA512 fccc99dd513c91dbb10e827bc7032d06cb37706e54b42e357bc6d9ddf3f059a858f11d0b20db89c1a253e18097e2add769e56dc6f709fa1eb5119a4db9500325
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUlY5ni+lDB4:equFIF0wuPlCKrjRAr9u
- TLSH T10186AE0273D85575F1B312318A359255AA39BCA58F32CA8F33883D5E6F716819E3A733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-29_d7dce100c0a37b0f1559a52d483283db_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-29_d7dce100c0a37b0f1559a52d483283db_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win11ltsc2024-20260629-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-29_d7dce100c0a37b0f1559a52d483283db_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_vidar
- Size 7.7MB
- SHA256 a0dc68db7015d7a5339326702445ae73cec568b69c9ca341e5e0440bb0ef2f39
- MD5 d7dce100c0a37b0f1559a52d483283db
- SHA1 1244596d12b496b6892cbd64672d49c9d41ff3ba
- SHA512 fccc99dd513c91dbb10e827bc7032d06cb37706e54b42e357bc6d9ddf3f059a858f11d0b20db89c1a253e18097e2add769e56dc6f709fa1eb5119a4db9500325
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUlY5ni+lDB4:equFIF0wuPlCKrjRAr9u
- TLSH T10186AE0273D85575F1B312318A359255AA39BCA58F32CA8F33883D5E6F716819E3A733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.