General
- Target 2026-07-01_95c4f594bf4b51b9e5bc939c341af51e_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_satacom_smoke-loader_vidar
- Size 7.8MB
- Sample260701-kt4y4scs8t
- SHA256 c42cd3deb7b78f502d9115cc2bd7afd92479ead159153b9d48b9007a1b26ba99
- MD5 95c4f594bf4b51b9e5bc939c341af51e
- SHA1 aaacae08e3c378b32023f620c2c88b3903c20c73
- SHA512 930a6832c8a6fa1cdd266f415b09df82fc965540a260a2d3625a9071bac42ac046cff1975b69ef2d6daac049006d0f99978123f75b70738e9ff946ceca87f632
- SSDEEP 98304:AKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUAKLZ1opDbSVHrjwz:AquFIF0wuPlCKrjRFLZ7pjwz
- TLSH T10186AE1276D84075F5B31631993492296A3ABCA59F32CA9F338C3D5D7FB16808A36733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-01_95c4f594bf4b51b9e5bc939c341af51e_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_95c4f594bf4b51b9e5bc939c341af51e_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win11ltsc2024-20260629-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-01_95c4f594bf4b51b9e5bc939c341af51e_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_satacom_smoke-loader_vidar
- Size 7.8MB
- SHA256 c42cd3deb7b78f502d9115cc2bd7afd92479ead159153b9d48b9007a1b26ba99
- MD5 95c4f594bf4b51b9e5bc939c341af51e
- SHA1 aaacae08e3c378b32023f620c2c88b3903c20c73
- SHA512 930a6832c8a6fa1cdd266f415b09df82fc965540a260a2d3625a9071bac42ac046cff1975b69ef2d6daac049006d0f99978123f75b70738e9ff946ceca87f632
- SSDEEP 98304:AKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUAKLZ1opDbSVHrjwz:AquFIF0wuPlCKrjRFLZ7pjwz
- TLSH T10186AE1276D84075F5B31631993492296A3ABCA59F32CA9F338C3D5D7FB16808A36733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.