General
- Target 2026-07-02_debcf05a561b604bf93722594614dbe4_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stop_vidar
- Size 7.2MB
- Sample260702-pzk6eaav3y
- SHA256 133f6f36fc4742deb384e65baab16ed59ecbfeac76c69cff79b6f788c9cc40fa
- MD5 debcf05a561b604bf93722594614dbe4
- SHA1 06b26131e9f2c0e12f3a716cb595d70055631ddf
- SHA512 53da5346bb2202b1690f65c3c5efc9419ea78e6a2a99b0c13ff9c17c02162cbf9be2a59848c4def0e3b708ce42775098a9d393414975fbdd0af208fb6abde8e9
- SSDEEP 98304:uKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TU+E6PFN:uquFIF0wuPlCKrjRQE6PD
- TLSH T1C176AE1273D44035F5B316319A3592586A79BCA59F32CA9F338C2D5E7FB16808A3A733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-02_debcf05a561b604bf93722594614dbe4_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_debcf05a561b604bf93722594614dbe4_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win11ltsc2024-20260630-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_debcf05a561b604bf93722594614dbe4_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stop_vidar
- Size 7.2MB
- SHA256 133f6f36fc4742deb384e65baab16ed59ecbfeac76c69cff79b6f788c9cc40fa
- MD5 debcf05a561b604bf93722594614dbe4
- SHA1 06b26131e9f2c0e12f3a716cb595d70055631ddf
- SHA512 53da5346bb2202b1690f65c3c5efc9419ea78e6a2a99b0c13ff9c17c02162cbf9be2a59848c4def0e3b708ce42775098a9d393414975fbdd0af208fb6abde8e9
- SSDEEP 98304:uKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TU+E6PFN:uquFIF0wuPlCKrjRQE6PD
- TLSH T1C176AE1273D44035F5B316319A3592586A79BCA59F32CA9F338C2D5E7FB16808A3A733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.