2026-06-29_05d91d831c2568506ccc4ef25f2f53a2_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_mafia_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_tofsee

General

Target
2026-06-29_05d91d831c2568506ccc4ef25f2f53a2_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_mafia_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_tofsee
Size 7.4MB
Sample260630-qpre4sf14v
SHA256 4d70c04d2fd0471df16a13ba568aaea0e2cda937682fb8ca873474d54a279d27
MD5 05d91d831c2568506ccc4ef25f2f53a2
SHA1 30bf5cfab148d8e7f80b00bb24e5ce105e240eea
SHA512 d3386f9a54f8e1cc39a098cb85cbde9b795834db4bb210079ebc61e3c50ef2214b3da00c173fee0583f9f11bf539ec0fe26659124d73ac57a69df74d2fa65488
SSDEEP 98304:NtKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUC07PLyiK:TquFIF0wuPlCKrjRnzY
TLSH
T1FD76AE1273D44075F5B316318A3592695A7ABCA58F32CA8F338C2D5E6F716808E3A737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-29_05d91d831c2568506ccc4ef25f2f53a2_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_mafia_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-06-29_05d91d831c2568506ccc4ef25f2f53a2_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_mafia_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_tofsee

.exe 7.4MB

2026-06-29_05d91d831c2568506ccc4ef25f2f53a2_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_mafia_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH 6a4b44fbce292023be72ed865b6c8979
SHA256 4d70c04d2fd0471df16a13ba568aaea0e2cda937682fb8ca873474d54a279d27
MD5 05d91d831c2568506ccc4ef25f2f53a2
SHA1 30bf5cfab148d8e7f80b00bb24e5ce105e240eea
SHA512 d3386f9a54f8e1cc39a098cb85cbde9b795834db4bb210079ebc61e3c50ef2214b3da00c173fee0583f9f11bf539ec0fe26659124d73ac57a69df74d2fa65488
SSDEEP 98304:NtKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUC07PLyiK:TquFIF0wuPlCKrjRnzY
TLSH
T1FD76AE1273D44075F5B316318A3592695A7ABCA58F32CA8F338C2D5E6F716808E3A737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects executables manipulated with Fody
AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12867

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\w32.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject FreeLibrary CreateProcessW GetCurrentProcess WaitForSingleObject GenerateConsoleCtrlEvent AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar CreateJobObjectA GetStdHandle GetLastError GetProcAddress LoadLibraryA SetConsoleCtrlHandler DuplicateHandle CloseHandle GetProcessHeap SetEndOfFile HeapReAlloc SetEnvironmentVariableW GetModuleHandleW DecodePointer HeapFree HeapAlloc GetStringTypeW GetCommandLineA HeapSetInformation GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount EncodePointer RtlUnwind DeleteCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW ReadFile SetHandleCount GetFileType SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep CreateFileW HeapSize GetConsoleCP GetConsoleMode SetStdHandle IsProcessorFeaturePresent FlushFileBuffers CompareStringW WriteConsoleW

shlwapi

StrStrIW PathRemoveFileSpecW PathCombineW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-29_05d91d831c2568506ccc4ef25f2f53a2_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_mafia_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

shlwapi

generic