2026-07-02_f33a9c46922c8b3f58c5b736ecd2a2b8_agent-tesla_amadey_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_stop_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-02_f33a9c46922c8b3f58c5b736ecd2a2b8_agent-tesla_amadey_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_stop_vidar
Size 5.3MB
Sample260702-xtdhdahx4l
SHA256 df67709ab0f078d3da99a9bb8c095bb21a58f9640a47c54abf8910510178f67a
MD5 f33a9c46922c8b3f58c5b736ecd2a2b8
SHA1 a95a9153f5101a50277d7c09c136e0b44cc1a696
SHA512 6d087b538095902d66708815b34d85bb69cd3936a6fe401bad00a5eec93a1bf8c54b683cb64926e158bf69a26d13ddcde8a371ab4eba5e1357a9174b2ffa59cb
SSDEEP 98304:3j2cPK8xbbKjKWQckVgtev5mnlNL4rKsW1+M5N5p7h+4jn:6CKooKWQc0gEYnvL4r1yfNjn
TLSH
T187467C0177D48635F5BB16329A7992685A7B7C609F328BCF13801E9E7EB06C09A35733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-02_f33a9c46922c8b3f58c5b736ecd2a2b8_agent-tesla_amadey_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_stop_vidar

File Explorer

2026-07-02_f33a9c46922c8b3f58c5b736ecd2a2b8_agent-tesla_amadey_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_stop_vidar

.exe 5.3MB

2026-07-02_f33a9c46922c8b3f58c5b736ecd2a2b8_agent-tesla_amadey_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_stop_vidar

IMPHASH 1a2e6fbe71caa18e49b7aebbc2eac135
SHA256 df67709ab0f078d3da99a9bb8c095bb21a58f9640a47c54abf8910510178f67a
MD5 f33a9c46922c8b3f58c5b736ecd2a2b8
SHA1 a95a9153f5101a50277d7c09c136e0b44cc1a696
SHA512 6d087b538095902d66708815b34d85bb69cd3936a6fe401bad00a5eec93a1bf8c54b683cb64926e158bf69a26d13ddcde8a371ab4eba5e1357a9174b2ffa59cb
SSDEEP 98304:3j2cPK8xbbKjKWQckVgtev5mnlNL4rKsW1+M5N5p7h+4jn:6CKooKWQc0gEYnvL4r1yfNjn
TLSH
T187467C0177D48635F5BB16329A7992685A7B7C609F328BCF13801E9E7EB06C09A35733
MD5 SHA1 SHA512 SSDEEP TLSH

AutoIT Executable

AutoIT scripts compiled to PE executables.
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

9e:d7:86:ae:0d:9b:8f:46:ca:6e:52:fe:0c:64:61:0b:d0:f9:46:ee:09:d8:4b:b4:76:ab:e9:6b:8c:ff:ef:f6

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 1, 2024

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 16, 2023 - Nov 14, 2024

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:0842-4BE6-C29A,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:da:8e:d5:c9:5a:00:d1:11:b1:00:01:00:00:01:da

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 12, 2023 - Jan 10, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

22768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

mighost.pdb

advapi32

RegCreateKeyExW RegSetValueExW RegCloseKey

kernel32

GetModuleFileNameW GetLastError GetFileAttributesW LocalFree HeapSetInformation SetUnhandledExceptionFilter OpenEventW OpenProcess SetErrorMode SetEvent CloseHandle TerminateProcess GetCurrentProcess SizeofResource LockResource LoadResource FindResourceExW InitializeCriticalSection DeleteCriticalSection CreateEventW EnterCriticalSection LeaveCriticalSection CreateThread ResumeThread OpenThread WaitForSingleObject WaitForMultipleObjects LoadLibraryExW GetProcAddress FreeLibrary GetCurrentThreadId GetStartupInfoW Sleep RaiseException HeapDestroy GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetTickCount RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetModuleHandleW

msvcrt

_exit _onexit __dllonexit _unlock _lock ?terminate@@YAXXZ ??1type_info@@UEAA@XZ __setusermatherr _commode _fmode _wcmdln _initterm _CxxThrowException _XcptFilter _amsg_exit __wgetmainargs exit calloc free vswprintf_s _vscwprintf memcpy_s memmove_s wcschr _wtol _wcsnicmp __C_specific_handler __CxxFrameHandler3 __set_app_type _cexit memset

ole32

CoRegisterClassObject CoRevokeClassObject CoInitializeEx CLSIDFromString StringFromGUID2 CoUninitialize CoDisconnectObject

user32

DispatchMessageW GetMessageW PostThreadMessageW MessageBoxW UnregisterClassA

shell32

CommandLineToArgvW

shlwapi

SHDeleteKeyW

wdscore

ConstructPartialMsgVW CurrentIP WdsSetupLogMessageW WdsInitialize WdsTerminate

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_f33a9c46922c8b3f58c5b736ecd2a2b8_agent-tesla_amadey_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_stop_vidar

PE Signature issue

advapi32

kernel32

msvcrt

ole32

user32

shell32

shlwapi

wdscore

generic