ad13b2c6ea2ec5f91800daee1fa75bf4b08a07d1ffda317305ab806b01e3ca5c

General

Target
2026-07-01_2a6bf43025b8e45c05fb8d5966f09177_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_vidar
Size 20.9MB
Sample260701-cavmbsd15t
SHA256 ad13b2c6ea2ec5f91800daee1fa75bf4b08a07d1ffda317305ab806b01e3ca5c
MD5 2a6bf43025b8e45c05fb8d5966f09177
SHA1 4393ccd26ee6e38d9641e9aff4b3d1d606013e11
SHA512 1bc0aa86e68a10c0e6daf2533bda7f3eecbb6b5233f6678cf406376d53f71a6be022fd8660b5c0799a8aa0852d6bd337384e350301725b57cc8c0d478a326d8b
SSDEEP 196608:equFIF0wuPlCKrjRc7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou1:/oUmmahvQHrc8u3xXJ/f4uUWHg
TLSH
T18527BF13739A81B5D06BD2B48A174212D77ABC540731A7DF22D47A6D2F73BE08B3A361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-01_2a6bf43025b8e45c05fb8d5966f09177_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_vidar
- Size 20.9MB
- SHA256 ad13b2c6ea2ec5f91800daee1fa75bf4b08a07d1ffda317305ab806b01e3ca5c
- MD5 2a6bf43025b8e45c05fb8d5966f09177
- SHA1 4393ccd26ee6e38d9641e9aff4b3d1d606013e11
- SHA512 1bc0aa86e68a10c0e6daf2533bda7f3eecbb6b5233f6678cf406376d53f71a6be022fd8660b5c0799a8aa0852d6bd337384e350301725b57cc8c0d478a326d8b
- SSDEEP 196608:equFIF0wuPlCKrjRc7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou1:/oUmmahvQHrc8u3xXJ/f4uUWHg
- TLSH
  T18527BF13739A81B5D06BD2B48A174212D77ABC540731A7DF22D47A6D2F73BE08B3A361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

ransomware spyware stealer adware persistence
- Detects executables manipulated with Fody
- Detects executables packed with Dotfuscator
- Detects executables packed with SmartAssembly
- Detects executables packed with Yano Obfuscator
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2