2026-07-03_2fe7194c6ec85674e8f30990df38f5dd_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_2fe7194c6ec85674e8f30990df38f5dd_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_vidar_wannacry
Size 22.7MB
Sample260703-dr5pasay7x
SHA256 cc1a871131634a8947f55fe42c025d70be134a0f5ade86f3d207f26b471ebf16
MD5 2fe7194c6ec85674e8f30990df38f5dd
SHA1 cfa9392d8eeec630b38c77349e205e70260474ae
SHA512 65e000ab2b9f2d018d98738204ee66e17360add4255df9998982866ed9e1dc18f72fd03d1888391ac18ceb0dab6e6c1167426618d883c8badac321ee7adfb58a
SSDEEP 196608:SWJquFIF0wuPlCKrjRvkgWTquFIF0wuPlCKrjRvkgWJquFIF0wuPlCKrjRvkgW:SJoUm1kgToUm1kgJoUm1kg
TLSH
T12E37AE1277D84075F5B3163189359229AA7ABCA55F32CA8F33882D5D7F716808E3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_2fe7194c6ec85674e8f30990df38f5dd_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_vidar_wannacry

File Explorer

2026-07-03_2fe7194c6ec85674e8f30990df38f5dd_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_vidar_wannacry

.exe 22.7MB

2026-07-03_2fe7194c6ec85674e8f30990df38f5dd_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_vidar_wannacry

IMPHASH 89ad82854409b9dd81837c899d65f03e
SHA256 cc1a871131634a8947f55fe42c025d70be134a0f5ade86f3d207f26b471ebf16
MD5 2fe7194c6ec85674e8f30990df38f5dd
SHA1 cfa9392d8eeec630b38c77349e205e70260474ae
SHA512 65e000ab2b9f2d018d98738204ee66e17360add4255df9998982866ed9e1dc18f72fd03d1888391ac18ceb0dab6e6c1167426618d883c8badac321ee7adfb58a
SSDEEP 196608:SWJquFIF0wuPlCKrjRvkgWTquFIF0wuPlCKrjRvkgWJquFIF0wuPlCKrjRvkgW:SJoUm1kgToUm1kgJoUm1kg
TLSH
T12E37AE1277D84075F5B3163189359229AA7ABCA55F32CA8F33882D5D7F716808E3A733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables manipulated with Fody
AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27871

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoInitialize CoCreateInstance CoUninitialize

comctl32

PropertySheetA CreatePropertySheetPageA

kernel32

LocalFree FormatMessageA FreeLibrary GetModuleHandleA GetVersionExA DeleteFileA GetPrivateProfileIntA GetPrivateProfileStringA ResumeThread SetPriorityClass GetCurrentProcess GetCurrentThread MultiByteToWideChar CreateProcessA GetModuleFileNameA RemoveDirectoryA GetFileSize GetTempFileNameA GetTempPathA LoadLibraryA GetProcAddress GetFileAttributesA GetStartupInfoA SetLastError MapViewOfFile CreateDirectoryA lstrlenA UnmapViewOfFile CreateFileA GetLastError DosDateTimeToFileTime SetFileTime CloseHandle CreateFileMappingA SetThreadPriority

user32

RegisterClassA CreateWindowExA ShowWindow UpdateWindow LoadCursorA SetCursor PeekMessageA TranslateMessage DispatchMessageA GetDlgItem GetWindowRect MoveWindow GetDC ReleaseDC SendDlgItemMessageA GetParent wsprintfA SetDlgItemTextA PostMessageA DefWindowProcA BeginPaint GetSystemMetrics EndPaint SendMessageA GetFocus MessageBoxA

gdi32

SelectObject TextOutA CreateDIBitmap CreateSolidBrush SetTextColor CreateFontA SetBkMode DeleteObject

advapi32

RegCloseKey RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegSetValueExA RegQueryValueA RegEnumKeyExA RegQueryValueExA RegOpenKeyExA

shell32

ShellExecuteA

msvcrt

_acmdln exit _XcptFilter _exit __p___argc __p___argv strncmp fgets realloc qsort __mb_cur_max __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 _open _controlfp _strcmpi _strdup _tempnam _close _read _strnicmp _isctype _pctype strchr memcpy memset strncat strcat strlen strcpy strcmp strrchr fprintf _vsnprintf malloc _snprintf strncpy free sscanf _putenv remove fread ftell fseek fopen fclose fflush freopen _iob fwrite strftime localtime time sprintf _fstat strtol

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_2fe7194c6ec85674e8f30990df38f5dd_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_vidar_wannacry

ole32

comctl32

kernel32

user32

gdi32

advapi32

shell32

msvcrt

generic