c16362144b18ec2e25123dac1a5f4dbb4e5e6f809986fbb601824ace4afb6afc

General

Target
2026-07-03_30634ca274843ac589914b5c52df20e9_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_wannacry
Size 28.5MB
Sample260703-dr2mmsfx6m
SHA256 c16362144b18ec2e25123dac1a5f4dbb4e5e6f809986fbb601824ace4afb6afc
MD5 30634ca274843ac589914b5c52df20e9
SHA1 82607c7ef4697fc5b112a04c0f6be40520ba26c0
SHA512 4067109fed63bc828c81aa2d002d11dfa0d3c3404bd3a00a7d69c258b065d575cc8bd844d618429d57cd94624129c2ae9ad8dc9402be03e039745b92cd9b51bf
SSDEEP 196608:QquFIF0wuPlCKrjRc4quFIF0wuPlCKrjRc4quFIF0wuPlCKrjRc4quFIF0wuPlCP:poUmmoUmmoUmmoUm
TLSH
T178679E0273D85475F5B316318A3592595A3ABCA58F32CA8F33882D5E6FB16C09E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-03_30634ca274843ac589914b5c52df20e9_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_wannacry
- Size 28.5MB
- SHA256 c16362144b18ec2e25123dac1a5f4dbb4e5e6f809986fbb601824ace4afb6afc
- MD5 30634ca274843ac589914b5c52df20e9
- SHA1 82607c7ef4697fc5b112a04c0f6be40520ba26c0
- SHA512 4067109fed63bc828c81aa2d002d11dfa0d3c3404bd3a00a7d69c258b065d575cc8bd844d618429d57cd94624129c2ae9ad8dc9402be03e039745b92cd9b51bf
- SSDEEP 196608:QquFIF0wuPlCKrjRc4quFIF0wuPlCKrjRc4quFIF0wuPlCKrjRc4quFIF0wuPlCP:poUmmoUmmoUmmoUm
- TLSH
  T178679E0273D85475F5B316318A3592595A3ABCA58F32CA8F33882D5E6FB16C09E39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

ransomware spyware stealer adware persistence
- Detects executables manipulated with Fody
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2