6dd92bac0dfec0379c55e27a717fce0f74e1f2eca1d57c3cc9b0ff45fbdffbff

General

Target
2026-06-30_9775ffdd1ddf5a790ab578d75b7037bd_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_vidar
Size 24.4MB
Sample260701-d95f9afw5z
SHA256 6dd92bac0dfec0379c55e27a717fce0f74e1f2eca1d57c3cc9b0ff45fbdffbff
MD5 9775ffdd1ddf5a790ab578d75b7037bd
SHA1 7029cb4b119e09ecbe86bb7521e10150a62291c4
SHA512 b4fba38054946d2bed8dbf4392bc143d823617e293a5386ee532815ae31ab76d449c1c2d14aa6b6ac6ba8919b6687348bdef7758677bae7e75d406b6c80c304e
SSDEEP 196608:equFIF0wuPlCK8quFIF0wuPlCKrjRKLZ7pjlquFIF0wuPlCK8quFIF0wuPlCKrj7:/oUqoUmQ7tQoUqoUmQ7te
TLSH
T11847AE1277D48031F5B316319A7592695A39BC658A33C99F338C2D9EBFB05C09A3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-30_9775ffdd1ddf5a790ab578d75b7037bd_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_vidar
- Size 24.4MB
- SHA256 6dd92bac0dfec0379c55e27a717fce0f74e1f2eca1d57c3cc9b0ff45fbdffbff
- MD5 9775ffdd1ddf5a790ab578d75b7037bd
- SHA1 7029cb4b119e09ecbe86bb7521e10150a62291c4
- SHA512 b4fba38054946d2bed8dbf4392bc143d823617e293a5386ee532815ae31ab76d449c1c2d14aa6b6ac6ba8919b6687348bdef7758677bae7e75d406b6c80c304e
- SSDEEP 196608:equFIF0wuPlCK8quFIF0wuPlCKrjRKLZ7pjlquFIF0wuPlCK8quFIF0wuPlCKrj7:/oUqoUmQ7tQoUqoUmQ7te
- TLSH
  T11847AE1277D48031F5B316319A7592695A39BC658A33C99F338C2D9EBFB05C09A3A733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

ransomware spyware stealer adware persistence
- Custom signature
  
  Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Custom signature
  
  Detects executables manipulated with Fody
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2