2026-07-02_a5f59a31f7c88b3e4cafc6c3a96d3f4d_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc

General

Target
2026-07-02_a5f59a31f7c88b3e4cafc6c3a96d3f4d_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc
Size 11.4MB
Sample260702-ylqcmsdw9v
SHA256 41d969f45f6343dba15397395295744c414dd7ed2d9f5bee9ec9af49204c7192
MD5 a5f59a31f7c88b3e4cafc6c3a96d3f4d
SHA1 26d35677942226b359232b11a250ccc300de42c9
SHA512 e3d42f515babc9164a01570e3699b290392760ad3fa2bc567844abe99f9a2a5466a2f2c9b013bcb1674a31213fce79f90680470ec64b9db45c6a5410f16b099c
SSDEEP 98304:NtKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xFKRuy5a/OU/jIEeQfoR/IuOFVf:TquFIF0wuPlCK8quFIF0wuPlCKrjRv
TLSH
T156C69E1277D58031F5B31631897592295679BCA58A338D9F338C2D9EAFB06C08E3A737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_a5f59a31f7c88b3e4cafc6c3a96d3f4d_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc

File Explorer

2026-07-02_a5f59a31f7c88b3e4cafc6c3a96d3f4d_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc

.exe 11.4MB

2026-07-02_a5f59a31f7c88b3e4cafc6c3a96d3f4d_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc

IMPHASH 6a4b44fbce292023be72ed865b6c8979
SHA256 41d969f45f6343dba15397395295744c414dd7ed2d9f5bee9ec9af49204c7192
MD5 a5f59a31f7c88b3e4cafc6c3a96d3f4d
SHA1 26d35677942226b359232b11a250ccc300de42c9
SHA512 e3d42f515babc9164a01570e3699b290392760ad3fa2bc567844abe99f9a2a5466a2f2c9b013bcb1674a31213fce79f90680470ec64b9db45c6a5410f16b099c
SSDEEP 98304:NtKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xFKRuy5a/OU/jIEeQfoR/IuOFVf:TquFIF0wuPlCK8quFIF0wuPlCKrjRv
TLSH
T156C69E1277D58031F5B31631897592295679BCA58A338D9F338C2D9EAFB06C08E3A737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects executables manipulated with Fody
AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12867

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\w32.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject FreeLibrary CreateProcessW GetCurrentProcess WaitForSingleObject GenerateConsoleCtrlEvent AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar CreateJobObjectA GetStdHandle GetLastError GetProcAddress LoadLibraryA SetConsoleCtrlHandler DuplicateHandle CloseHandle GetProcessHeap SetEndOfFile HeapReAlloc SetEnvironmentVariableW GetModuleHandleW DecodePointer HeapFree HeapAlloc GetStringTypeW GetCommandLineA HeapSetInformation GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount EncodePointer RtlUnwind DeleteCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW ReadFile SetHandleCount GetFileType SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep CreateFileW HeapSize GetConsoleCP GetConsoleMode SetStdHandle IsProcessorFeaturePresent FlushFileBuffers CompareStringW WriteConsoleW

shlwapi

StrStrIW PathRemoveFileSpecW PathCombineW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_a5f59a31f7c88b3e4cafc6c3a96d3f4d_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc

kernel32

shlwapi

generic