2026-07-02_fa09b9f8486a5cf0c2638d7175a10477_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_icedid_njrat_poet-rat_remcos_satacom_vidar

General

Target
2026-07-02_fa09b9f8486a5cf0c2638d7175a10477_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_icedid_njrat_poet-rat_remcos_satacom_vidar
Size 5.5MB
Sample260702-mrpgrags2t
SHA256 250326cf7c0f618853f45d4cf83b7dea1c8b72ea72f693fc8bf5f52895fe6bb1
MD5 fa09b9f8486a5cf0c2638d7175a10477
SHA1 5f267a882fbbd7932f94f4d9426fc06019709eea
SHA512 abfb98b43726054a32ef0e90b8f2850b9e73679402a90774024caa8ff795b0a61b48181da06ae21cda40c2947a277a5e6a141308440a93588a59cfb128e1922f
SSDEEP 98304:D2cPK8xbts/fh6ImzzJoDfuBcMv+A73XA:qCK0tsHh6ImzD+F
TLSH
T119468D41FADB94F5EA03453149A7A26F6331B9098336CBC7C7405EA6FD636E21E37212
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-02_fa09b9f8486a5cf0c2638d7175a10477_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_icedid_njrat_poet-rat_remcos_satacom_vidar

File Explorer

2026-07-02_fa09b9f8486a5cf0c2638d7175a10477_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_icedid_njrat_poet-rat_remcos_satacom_vidar

.exe 5.5MB

2026-07-02_fa09b9f8486a5cf0c2638d7175a10477_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_icedid_njrat_poet-rat_remcos_satacom_vidar

IMPHASH bd0209159477d5bdde0d128d71f399eb
SHA256 250326cf7c0f618853f45d4cf83b7dea1c8b72ea72f693fc8bf5f52895fe6bb1
MD5 fa09b9f8486a5cf0c2638d7175a10477
SHA1 5f267a882fbbd7932f94f4d9426fc06019709eea
SHA512 abfb98b43726054a32ef0e90b8f2850b9e73679402a90774024caa8ff795b0a61b48181da06ae21cda40c2947a277a5e6a141308440a93588a59cfb128e1922f
SSDEEP 98304:D2cPK8xbts/fh6ImzzJoDfuBcMv+A73XA:qCK0tsHh6ImzD+F
TLSH
T119468D41FADB94F5EA03453149A7A26F6331B9098336CBC7C7405EA6FD636E21E37212
MD5 SHA1 SHA512 SSDEEP TLSH

AutoIT Executable

AutoIT scripts compiled to PE executables.
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8a:d1:ef:5a:ae:39:21:9c:93:60:bd:2c:d2:77:80:03:81:be:b9:31:61:9e:69:75:e2:5c:bb:2f:50:1a:b4:32

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 23, 2020

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:65:51:ae:1b:bd:00:5c:bf:bd:00:00:00:00:02:65

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 4, 2020 - Mar 3, 2021

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F77F-E356-5BAE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:2a:e8:17:96:f8:86:a7:ef:a3:00:00:00:00:01:2a

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 19, 2019 - Mar 17, 2021

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

0

Major OS version

10

Entry point

4960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

MsMpEngCP.pdb

2026-07-02_fa09b9f8486a5cf0c2638d7175a10477_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_icedid_njrat_poet-rat_remcos_satacom_vidar

PE Signature issue

kernel32

ntdll

api-ms-win-core-winrt-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

generic

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_fa09b9f8486a5cf0c2638d7175a10477_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hawkeye_icedid_njrat_poet-rat_remcos_satacom_vidar

PE Signature issue

kernel32

ntdll

api-ms-win-core-winrt-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

generic