3349b04a6e178dcd18c3832341d5b016d13b0c2e54b4c66df10bbf0861443020

General

Target
2026-07-01_7f5a87cf3596d0c2f735caa8aa8eb454_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_vidar
Size 16.9MB
Sample260702-adn8lsf15p
SHA256 3349b04a6e178dcd18c3832341d5b016d13b0c2e54b4c66df10bbf0861443020
MD5 7f5a87cf3596d0c2f735caa8aa8eb454
SHA1 dee386736c497fb317c8ee62f1edb14323874fc1
SHA512 e6ed8e1b39f0f59bae3e87a24302ae008d50d50065fc93c77cebaed48715fe398790552f9f72935578d18a078a9e7be14afec492fed21fb47a3cca0064c0cbd6
SSDEEP 196608:uquFIF0wuPlCKrjRULBquFIF0wuPlCKrjRULg+:PoUmWEoUmWg+
TLSH
T16907AE1273D88075F1B7413189359215EA76BC598B32CADF32882D6E6FB26D09E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-01_7f5a87cf3596d0c2f735caa8aa8eb454_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_vidar
- Size 16.9MB
- SHA256 3349b04a6e178dcd18c3832341d5b016d13b0c2e54b4c66df10bbf0861443020
- MD5 7f5a87cf3596d0c2f735caa8aa8eb454
- SHA1 dee386736c497fb317c8ee62f1edb14323874fc1
- SHA512 e6ed8e1b39f0f59bae3e87a24302ae008d50d50065fc93c77cebaed48715fe398790552f9f72935578d18a078a9e7be14afec492fed21fb47a3cca0064c0cbd6
- SSDEEP 196608:uquFIF0wuPlCKrjRULBquFIF0wuPlCKrjRULg+:PoUmWEoUmWg+
- TLSH
  T16907AE1273D88075F1B7413189359215EA76BC598B32CADF32882D6E6FB26D09E39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

ransomware spyware stealer adware persistence
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Detects executables manipulated with Fody
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2