2026-06-30_75619ec3f9c8f1b486101748c8d92aaa_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_satacom_smoke-loader

General

Target
2026-06-30_75619ec3f9c8f1b486101748c8d92aaa_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_satacom_smoke-loader
Size 8.0MB
Sample260701-exyzdaes3p
SHA256 84c49f6c2c82f0c596be47ab9d620cb76092f07baebb2a36b1a4dcef886b403a
MD5 75619ec3f9c8f1b486101748c8d92aaa
SHA1 ac7d49d64d21a1c80b98bcd85d27cfdb5ef4b7cd
SHA512 52cd317076a5d6149365f3ee905782502fab255b324d860fda56a4bb50070774f65e85999b9975391ee3ec4420c73d64ef047cb793eab42d738fa841ee5e190b
SSDEEP 98304:qKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUx5LZ1opDbSVHrjK:qquFIF0wuPlCKrjRv5LZ7pjK
TLSH
T1FF869E1276D84075F1B316319A3596646A3ABCA58F32C99F33882D5DBFB16C08E36733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-30_75619ec3f9c8f1b486101748c8d92aaa_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_satacom_smoke-loader

File Explorer

2026-06-30_75619ec3f9c8f1b486101748c8d92aaa_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_satacom_smoke-loader

.exe 8.0MB

2026-06-30_75619ec3f9c8f1b486101748c8d92aaa_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_satacom_smoke-loader

IMPHASH f0ea749f47650b36d9712c2c487f984b
SHA256 84c49f6c2c82f0c596be47ab9d620cb76092f07baebb2a36b1a4dcef886b403a
MD5 75619ec3f9c8f1b486101748c8d92aaa
SHA1 ac7d49d64d21a1c80b98bcd85d27cfdb5ef4b7cd
SHA512 52cd317076a5d6149365f3ee905782502fab255b324d860fda56a4bb50070774f65e85999b9975391ee3ec4420c73d64ef047cb793eab42d738fa841ee5e190b
SSDEEP 98304:qKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUx5LZ1opDbSVHrjK:qquFIF0wuPlCKrjRv5LZ7pjK
TLSH
T1FF869E1276D84075F1B316319A3596646A3ABCA58F32C99F33882D5DBFB16C08E36733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables manipulated with Fody
AutoIT Executable

AutoIT scripts compiled to PE executables.
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

f3:b4:36:68:d2:ee:81:a8:66:18:65:74:a3:82:20:3c:ab:ae:57:23:0e:de:b1:f6:de:df:17:d7:a5:59:78:47

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

Chains

May 17, 2022

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

Serial Number

07:1f:14:1b:8b:30:0d:25:f3:14:eb:23:0c:d0:d1:dd

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 17, 2022 - Jan 15, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Minor OS version

0

Major OS version

6

Entry point

4948

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\_w\1\b\bin\amd64\python.pdb

2026-06-30_75619ec3f9c8f1b486101748c8d92aaa_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_satacom_smoke-loader

PE Signature issue

python39

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_75619ec3f9c8f1b486101748c8d92aaa_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_satacom_smoke-loader

PE Signature issue

python39

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

generic