2026-06-30_fbd4f8071d9c4e2d0c9e0c7e70510cc8_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_rugmi_satacom_smoke-loader_stop_vidar

General

Target
2026-06-30_fbd4f8071d9c4e2d0c9e0c7e70510cc8_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_rugmi_satacom_smoke-loader_stop_vidar
Size 7.7MB
Sample260701-cd5xgact5m
SHA256 df69c3b865382b8ea04b5e1fc3eee6f2c225771bcf308154f66311b227c5dcd5
MD5 fbd4f8071d9c4e2d0c9e0c7e70510cc8
SHA1 b660a09fd4c1e7fdba8990d3b27ac35f6510d186
SHA512 eb0390f0e0f88cc37e52201b2a2ae325062d9a97aa2712698c5d1bfadca7c8c848fedee663efdbe8589341570a37ed61f5f84fadcd2d78facd3c496701108251
SSDEEP 98304:OKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TU+ETLZ1opDbSVHrj:OquFIF0wuPlCKrjRQETLZ7pj
TLSH
T16A86AE1273D44035F5B316319A3592656A79BCA58F32CA9F33C82D5E7FB16808A3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_fbd4f8071d9c4e2d0c9e0c7e70510cc8_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_rugmi_satacom_smoke-loader_stop_vidar

File Explorer

2026-06-30_fbd4f8071d9c4e2d0c9e0c7e70510cc8_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_rugmi_satacom_smoke-loader_stop_vidar

.exe 7.7MB

2026-06-30_fbd4f8071d9c4e2d0c9e0c7e70510cc8_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_rugmi_satacom_smoke-loader_stop_vidar

IMPHASH ad2258898f0fbdcaaa6098836dd9129f
SHA256 df69c3b865382b8ea04b5e1fc3eee6f2c225771bcf308154f66311b227c5dcd5
MD5 fbd4f8071d9c4e2d0c9e0c7e70510cc8
SHA1 b660a09fd4c1e7fdba8990d3b27ac35f6510d186
SHA512 eb0390f0e0f88cc37e52201b2a2ae325062d9a97aa2712698c5d1bfadca7c8c848fedee663efdbe8589341570a37ed61f5f84fadcd2d78facd3c496701108251
SSDEEP 98304:OKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TU+ETLZ1opDbSVHrj:OquFIF0wuPlCKrjRQETLZ7pj
TLSH
T16A86AE1273D44035F5B316319A3592656A79BCA58F32CA9F33C82D5E7FB16808A3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables manipulated with Fody
AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

17932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\w64.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject FreeLibrary CreateProcessW SetHandleInformation WaitForSingleObjectEx AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar GetStartupInfoW GetTempPathW CreateJobObjectA GetStdHandle GetLastError GetProcAddress SetStdHandle LoadLibraryA GetFileType SetConsoleCtrlHandler SetCurrentDirectoryW CloseHandle GetProcessHeap SetEndOfFile SetEnvironmentVariableW CompareStringW FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc GetModuleHandleW DecodePointer HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EncodePointer TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount GetCommandLineA RtlUnwindEx DeleteCriticalSection LoadLibraryW FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc WriteFile HeapSetInformation GetVersion HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount Sleep LCMapStringW ReadFile SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime CreateFileW HeapSize WriteConsoleW

user32

PostMessageW WaitForInputIdle PeekMessageW CreateWindowExW GetMessageW DestroyWindow

shlwapi

PathCombineW StrStrIW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_fbd4f8071d9c4e2d0c9e0c7e70510cc8_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_rugmi_satacom_smoke-loader_stop_vidar

kernel32

user32

shlwapi

generic