General
- Target 2026-07-02_cc3407b1cd3458b366b366da89a3dafa_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stop
- Size 15.0MB
- Sample260703-bf7y6set2n
- SHA256 a3ae0d538e36cf94d2dc1c1b53e1da929a000d311c458be74778eb7acde6e2a3
- MD5 cc3407b1cd3458b366b366da89a3dafa
- SHA1 8f1227e253b2a6674cc84c7691c530c1b3cfc5e9
- SHA512 2597875a6ac0db0c78a86bb0fe961a71b513dd0a14ebf365155475585ccef426452b98e347893a9cf96eddcf2c6fe1f103f4bb7e86a8a748dae7fec090fe368b
- SSDEEP 196608:QquFIF0wuPlCKrjRoLZ7pjA7quFIF0wuPlCKrjRoLZ7pjA:poUm+7tboUm+7t
- TLSH T164F6AE1272D84035F5B316319A3592656A39BCA54F32CA9F338C3D5E7FB16809A3A733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-02_cc3407b1cd3458b366b366da89a3dafa_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_cc3407b1cd3458b366b366da89a3dafa_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win11ltsc2024-20260629-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_cc3407b1cd3458b366b366da89a3dafa_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stop
- Size 15.0MB
- SHA256 a3ae0d538e36cf94d2dc1c1b53e1da929a000d311c458be74778eb7acde6e2a3
- MD5 cc3407b1cd3458b366b366da89a3dafa
- SHA1 8f1227e253b2a6674cc84c7691c530c1b3cfc5e9
- SHA512 2597875a6ac0db0c78a86bb0fe961a71b513dd0a14ebf365155475585ccef426452b98e347893a9cf96eddcf2c6fe1f103f4bb7e86a8a748dae7fec090fe368b
- SSDEEP 196608:QquFIF0wuPlCKrjRoLZ7pjA7quFIF0wuPlCKrjRoLZ7pjA:poUm+7tboUm+7t
- TLSH T164F6AE1272D84035F5B316319A3592656A39BCA54F32CA9F338C3D5E7FB16809A3A733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.