General
- Target 2026-06-29_be76267ca6d677e5e6316db91a35479a_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_rugmi_satacom_smoke-loader_stealc_stop
- Size 7.3MB
- Sample260630-epp2haex8k
- SHA256 13ee6b9d937f271f280f352eb773876f10c9b566576cfd2fe19470eae9cbc041
Score
10/10
Malware Config
Targets
-
- Target 2026-06-29_be76267ca6d677e5e6316db91a35479a_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_rugmi_satacom_smoke-loader_stealc_stop
- Size 7.3MB
- SHA256 13ee6b9d937f271f280f352eb773876f10c9b566576cfd2fe19470eae9cbc041
Score9/10-
Detects executables manipulated with Fody
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.