General
- Target 2026-07-01_81332adf57bfeb90d9792ae3d7bb12d2_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_rugmi_satacom_smoke-loader_stop
- Size 7.8MB
- Sample260701-k72e5scw9s
- SHA256 04ec8841d18b55bf22ad40dabc41b6a10b341ab83d6de85e732d9c35da8e7fe5
- MD5 81332adf57bfeb90d9792ae3d7bb12d2
- SHA1 0fae1c19cc66b35225c9aeddaa0ae89819b56ce6
- SHA512 90ff77fec5a9c5d8978e43323e2a3c867bde8d46eb5e88d5c110dbdc5df5ac7ae067c7c4704a0a0974ff0967b86810c30d669b55d34e17e0095e9be0952dd35a
- SSDEEP 98304:QKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUlpLZ1opDbSVHrjX4SEh:QquFIF0wuPlCKrjRJLZ7pjX
- TLSH T1FF86AE1276D48035F5B316319A3592256A79BCA54F32CA9F33CC2D5E7FB06808A3A737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-01_81332adf57bfeb90d9792ae3d7bb12d2_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_81332adf57bfeb90d9792ae3d7bb12d2_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win11ltsc2024-20260629-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-01_81332adf57bfeb90d9792ae3d7bb12d2_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_rugmi_satacom_smoke-loader_stop
- Size 7.8MB
- SHA256 04ec8841d18b55bf22ad40dabc41b6a10b341ab83d6de85e732d9c35da8e7fe5
- MD5 81332adf57bfeb90d9792ae3d7bb12d2
- SHA1 0fae1c19cc66b35225c9aeddaa0ae89819b56ce6
- SHA512 90ff77fec5a9c5d8978e43323e2a3c867bde8d46eb5e88d5c110dbdc5df5ac7ae067c7c4704a0a0974ff0967b86810c30d669b55d34e17e0095e9be0952dd35a
- SSDEEP 98304:QKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUlpLZ1opDbSVHrjX4SEh:QquFIF0wuPlCKrjRJLZ7pjX
- TLSH T1FF86AE1276D48035F5B316319A3592256A79BCA54F32CA9F33CC2D5E7FB06808A3A737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detects executables manipulated with Fody
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
AutoIT Executable
AutoIT scripts compiled to PE executables.