General
- Target 2026-06-30_6cc390cdf22d08c4de4e57ec16814861_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_poet-rat_remcos_satacom_smoke-loader_vidar
- Size 18.2MB
- Sample260701-e4nf8agt2y
- SHA256 08e6c7f43efc62794a74badda1b1eb6c2229ee41a99edca0d459abfa6e97cec6
- MD5 6cc390cdf22d08c4de4e57ec16814861
- SHA1 34235ba468660457d22d26e8ba2a3b01aa49ebfd
- SHA512 ec1004faf7e8c4a67a8c964fa80bb211bda465c93fc3d70e903718bb13e4352bf83bfd22df056bd23a5f8cb1cb7646e23de7c87b1ba697f1d82f2025824e5d48
- SSDEEP 196608:uquFIF0wuPlCKrjRvE4quFIF0wuPlCKrjRvEqhHh6ImzD+F:PoUm1eoUm1m
- TLSH T1F117AF01B6D64071F57316318A76936A5739BC558B32CACFA3882D5EBF726C08A36733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-30_6cc390cdf22d08c4de4e57ec16814861_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_6cc390cdf22d08c4de4e57ec16814861_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
Resource
win11ltsc2024-20260629-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-30_6cc390cdf22d08c4de4e57ec16814861_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_poet-rat_remcos_satacom_smoke-loader_vidar
- Size 18.2MB
- SHA256 08e6c7f43efc62794a74badda1b1eb6c2229ee41a99edca0d459abfa6e97cec6
- MD5 6cc390cdf22d08c4de4e57ec16814861
- SHA1 34235ba468660457d22d26e8ba2a3b01aa49ebfd
- SHA512 ec1004faf7e8c4a67a8c964fa80bb211bda465c93fc3d70e903718bb13e4352bf83bfd22df056bd23a5f8cb1cb7646e23de7c87b1ba697f1d82f2025824e5d48
- SSDEEP 196608:uquFIF0wuPlCKrjRvE4quFIF0wuPlCKrjRvEqhHh6ImzD+F:PoUm1eoUm1m
- TLSH T1F117AF01B6D64071F57316318A76936A5739BC558B32CACFA3882D5EBF726C08A36733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.