2026-06-29_b7b13cf9f54cf174d58da0a8d7b2b071_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stop_tofsee

General

Target
2026-06-29_b7b13cf9f54cf174d58da0a8d7b2b071_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stop_tofsee
Size 7.7MB
Sample260630-e33vhsew21
SHA256 060466ac272443b2aa8e9d9c879acf9eaf1626e69a342bbebef582d4b73e128c
MD5 b7b13cf9f54cf174d58da0a8d7b2b071
SHA1 3f0700018d1528e7b28f5dbb4a2b7038000099b9
SHA512 f0f7c6c670c1eb8b3ceb6e5d683d8e5d1024f2dd061c659984632ec2afbd62ef276493a253c16a39dd7033468b11039199f10847a229405f34744c6063a1d6a0
SSDEEP 98304:gKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TU67bNOh6PFN:gquFIF0wuPlCKrjRc7bNOAPD
TLSH
T16986AE1272D89475F1B312319A3592655A39BC654F32CA8F33883E5E7F706C1AA3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-29_b7b13cf9f54cf174d58da0a8d7b2b071_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stop_tofsee

File Explorer

2026-06-29_b7b13cf9f54cf174d58da0a8d7b2b071_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stop_tofsee

.exe 7.7MB

2026-06-29_b7b13cf9f54cf174d58da0a8d7b2b071_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stop_tofsee

IMPHASH ad2258898f0fbdcaaa6098836dd9129f
SHA256 060466ac272443b2aa8e9d9c879acf9eaf1626e69a342bbebef582d4b73e128c
MD5 b7b13cf9f54cf174d58da0a8d7b2b071
SHA1 3f0700018d1528e7b28f5dbb4a2b7038000099b9
SHA512 f0f7c6c670c1eb8b3ceb6e5d683d8e5d1024f2dd061c659984632ec2afbd62ef276493a253c16a39dd7033468b11039199f10847a229405f34744c6063a1d6a0
SSDEEP 98304:gKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TU67bNOh6PFN:gquFIF0wuPlCKrjRc7bNOAPD
TLSH
T16986AE1272D89475F1B312319A3592655A39BC654F32CA8F33883E5E7F706C1AA3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables manipulated with Fody
AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

17932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\w64.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject FreeLibrary CreateProcessW SetHandleInformation WaitForSingleObjectEx AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar GetStartupInfoW GetTempPathW CreateJobObjectA GetStdHandle GetLastError GetProcAddress SetStdHandle LoadLibraryA GetFileType SetConsoleCtrlHandler SetCurrentDirectoryW CloseHandle GetProcessHeap SetEndOfFile SetEnvironmentVariableW CompareStringW FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc GetModuleHandleW DecodePointer HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EncodePointer TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount GetCommandLineA RtlUnwindEx DeleteCriticalSection LoadLibraryW FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc WriteFile HeapSetInformation GetVersion HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount Sleep LCMapStringW ReadFile SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime CreateFileW HeapSize WriteConsoleW

user32

PostMessageW WaitForInputIdle PeekMessageW CreateWindowExW GetMessageW DestroyWindow

shlwapi

PathCombineW StrStrIW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-29_b7b13cf9f54cf174d58da0a8d7b2b071_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stop_tofsee

kernel32

user32

shlwapi

generic