2026-07-01_c5ed571cf9c4e25bc9c3a450bd022e03_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_tofsee

General

Target
2026-07-01_c5ed571cf9c4e25bc9c3a450bd022e03_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_tofsee
Size 7.5MB
Sample260701-nmsjaaex6x
SHA256 37c297e48bdd16ef48f8681615cce8ba29127970333c97ac8ad1cc0915bdf37f
MD5 c5ed571cf9c4e25bc9c3a450bd022e03
SHA1 022319ca91cc7b52754e8ca8fda39ba22ada0db1
SHA512 2759175bfe9daa9e6bb7e8942b5622bf90c5abaf95dfd7a3b4b4860020d78cad0067850b10e4de71b23da7a48d40a86a9c28871821f8603073bdb95554070a12
SSDEEP 98304:LKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUV5nmP:LquFIF0wuPlCKrjRdmP
TLSH
T17A868D0272D44075F5B316318B7693A55B7ABCA58B32CA8F33882D5E6F716809E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-01_c5ed571cf9c4e25bc9c3a450bd022e03_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_tofsee

File Explorer

2026-07-01_c5ed571cf9c4e25bc9c3a450bd022e03_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_tofsee

.exe 7.5MB

2026-07-01_c5ed571cf9c4e25bc9c3a450bd022e03_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_tofsee

IMPHASH f0ea749f47650b36d9712c2c487f984b
SHA256 37c297e48bdd16ef48f8681615cce8ba29127970333c97ac8ad1cc0915bdf37f
MD5 c5ed571cf9c4e25bc9c3a450bd022e03
SHA1 022319ca91cc7b52754e8ca8fda39ba22ada0db1
SHA512 2759175bfe9daa9e6bb7e8942b5622bf90c5abaf95dfd7a3b4b4860020d78cad0067850b10e4de71b23da7a48d40a86a9c28871821f8603073bdb95554070a12
SSDEEP 98304:LKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUV5nmP:LquFIF0wuPlCKrjRdmP
TLSH
T17A868D0272D44075F5B316318B7693A55B7ABCA58B32CA8F33882D5E6F716809E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables manipulated with Fody
AutoIT Executable

AutoIT scripts compiled to PE executables.
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

52:f1:6e:7f:27:87:c2:c5:cd:e8:6d:d4:8e:f7:f1:de:b5:c8:77:3c:4b:97:ea:77:4d:20:9b:cb:3d:53:44:1d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

Chains

May 17, 2022

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

Serial Number

07:1f:14:1b:8b:30:0d:25:f3:14:eb:23:0c:d0:d1:dd

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 17, 2022 - Jan 15, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Minor OS version

0

Major OS version

6

Entry point

4948

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\_w\1\b\bin\amd64\python.pdb

2026-07-01_c5ed571cf9c4e25bc9c3a450bd022e03_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_tofsee

PE Signature issue

python39

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-01_c5ed571cf9c4e25bc9c3a450bd022e03_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_tofsee

PE Signature issue

python39

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

generic