General
- Target 2026-07-03_32fcd7df48721a008e95d2af4f21f9fc_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_wannacry
- Size 6.9MB
- Sample260703-f8r6msgx2n
- SHA256 8760a0169da5d44a5fc601cea8b4db7516efe5403820b653ff328a3c8ecb3ff3
- MD5 32fcd7df48721a008e95d2af4f21f9fc
- SHA1 0f821004ec95c784d5a4915658c84d25dce589fd
- SHA512 0f3ddf5b3d6719a5afbf46b1468993159fed88d6b0fe190acf96a3a0453a11f2e79c2191edece5ced15628f0882d3730599486805b7bf0f5f1a1816bc0945539
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUxy:equFIF0wuPlCKrjR
- TLSH T145769E0273D84075F5B316319A759269663ABCA58F33CA9F328C2D5D6FB16808E39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-03_32fcd7df48721a008e95d2af4f21f9fc_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_32fcd7df48721a008e95d2af4f21f9fc_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win11ltsc2024-20260629-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-03_32fcd7df48721a008e95d2af4f21f9fc_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_wannacry
- Size 6.9MB
- SHA256 8760a0169da5d44a5fc601cea8b4db7516efe5403820b653ff328a3c8ecb3ff3
- MD5 32fcd7df48721a008e95d2af4f21f9fc
- SHA1 0f821004ec95c784d5a4915658c84d25dce589fd
- SHA512 0f3ddf5b3d6719a5afbf46b1468993159fed88d6b0fe190acf96a3a0453a11f2e79c2191edece5ced15628f0882d3730599486805b7bf0f5f1a1816bc0945539
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUxy:equFIF0wuPlCKrjR
- TLSH T145769E0273D84075F5B316319A759269663ABCA58F33CA9F328C2D5D6FB16808E39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.