General
- Target 2026-07-02_dfc4555c6fd04b48b6dd7ec6b3a54abf_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_tofsee
- Size 7.2MB
- Sample260702-mxtzesgt51
- SHA256 223633a2bf4e0b847bb6214f360083baecb2bf287fe8cd4b68f640cef8f0f84a
- MD5 dfc4555c6fd04b48b6dd7ec6b3a54abf
- SHA1 f646ee64d195befc95e93c723e59f30b31682203
- SHA512 9767fac7da59cf5c675c98ad09c4d1aa0c88e7a0e42534055c2e469567674b3d43e113fb2c8b8adce8ed360dfe74537a5a19eb272b90cc65c07842f91711c8dc
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUx3wPFN:equFIF0wuPlCKrjRv3wPD
- TLSH T12C769E1273D44035F5B31631997592286A7ABCA59F32CA9F328C2D5D7FB16808E3A733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-02_dfc4555c6fd04b48b6dd7ec6b3a54abf_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_dfc4555c6fd04b48b6dd7ec6b3a54abf_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win11ltsc2024-20260630-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_dfc4555c6fd04b48b6dd7ec6b3a54abf_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_tofsee
- Size 7.2MB
- SHA256 223633a2bf4e0b847bb6214f360083baecb2bf287fe8cd4b68f640cef8f0f84a
- MD5 dfc4555c6fd04b48b6dd7ec6b3a54abf
- SHA1 f646ee64d195befc95e93c723e59f30b31682203
- SHA512 9767fac7da59cf5c675c98ad09c4d1aa0c88e7a0e42534055c2e469567674b3d43e113fb2c8b8adce8ed360dfe74537a5a19eb272b90cc65c07842f91711c8dc
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUx3wPFN:equFIF0wuPlCKrjRv3wPD
- TLSH T12C769E1273D44035F5B31631997592286A7ABCA59F32CA9F328C2D5D7FB16808E3A733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.