03b9e51b66821fc55c8f7f24491b5fbd6d1a011d46f48490bfafb3c2d4311ba2

General

Target
2026-07-01_2029b462c594ee4153e563cb792bd3a8_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_rugmi_satacom_smoke-loader_stop_tofsee_vidar
Size 8.0MB
Sample260701-s248vabs81
SHA256 03b9e51b66821fc55c8f7f24491b5fbd6d1a011d46f48490bfafb3c2d4311ba2
MD5 2029b462c594ee4153e563cb792bd3a8
SHA1 c3b0d07aa08364e9f41c911064efd0c27ba70757
SHA512 15bedb720da3484c0c4f6b8e107592a7a8ea06e38c8b05dd84be89c06d252a40530d4e80c58d525756591562407d094521d778d976b306e69734de0008f8ecd3
SSDEEP 98304:uKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUApLZ1opDbSVHrjSC5:uquFIF0wuPlCKrjR2LZ7pjSC5
TLSH
T1AA86AE1273D84075F5B316319A3592646A79BCA58F32CA8F33C82D5E7F716809A3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-01_2029b462c594ee4153e563cb792bd3a8_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_rugmi_satacom_smoke-loader_stop_tofsee_vidar
- Size 8.0MB
- SHA256 03b9e51b66821fc55c8f7f24491b5fbd6d1a011d46f48490bfafb3c2d4311ba2
- MD5 2029b462c594ee4153e563cb792bd3a8
- SHA1 c3b0d07aa08364e9f41c911064efd0c27ba70757
- SHA512 15bedb720da3484c0c4f6b8e107592a7a8ea06e38c8b05dd84be89c06d252a40530d4e80c58d525756591562407d094521d778d976b306e69734de0008f8ecd3
- SSDEEP 98304:uKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUApLZ1opDbSVHrjSC5:uquFIF0wuPlCKrjR2LZ7pjSC5
- TLSH
  T1AA86AE1273D84075F5B316319A3592646A79BCA58F32CA8F33C82D5E7F716809A3A733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

ransomware spyware stealer adware persistence
- Detects executables manipulated with Fody
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2