2026-07-04_e06cafdaa70c040b54dd439ce465f832_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc

General

Target
2026-07-04_e06cafdaa70c040b54dd439ce465f832_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc
Size 8.2MB
Sample260704-jythhacy7v
SHA256 fef73ad82c6172d0d83490efb68a8efb0beea8b5c4fea94068a0afc68874f6d0
MD5 e06cafdaa70c040b54dd439ce465f832
SHA1 f364fd2c5b339f067d37035af14d60c85b6d0d05
SHA512 11abcb5a63f558361d5365396b4998d930ca73c7443001c3e42b6671910d251d1190e14bcc2f8528a939c12fa5330246e979320bb06cd8add99624a5ff196bd3
SSDEEP 98304:NqKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUN2KsW1+M5Nn:0quFIF0wuPlCKrjRm1yn
TLSH
T1D9868D1173D84535F1B316319A7992645A7ABCA59F32CACF33882D5E6F70AC08A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-04_e06cafdaa70c040b54dd439ce465f832_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc

File Explorer

2026-07-04_e06cafdaa70c040b54dd439ce465f832_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc

.exe 8.2MB

2026-07-04_e06cafdaa70c040b54dd439ce465f832_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc

IMPHASH 6a4b44fbce292023be72ed865b6c8979
SHA256 fef73ad82c6172d0d83490efb68a8efb0beea8b5c4fea94068a0afc68874f6d0
MD5 e06cafdaa70c040b54dd439ce465f832
SHA1 f364fd2c5b339f067d37035af14d60c85b6d0d05
SHA512 11abcb5a63f558361d5365396b4998d930ca73c7443001c3e42b6671910d251d1190e14bcc2f8528a939c12fa5330246e979320bb06cd8add99624a5ff196bd3
SSDEEP 98304:NqKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUN2KsW1+M5Nn:0quFIF0wuPlCKrjRm1yn
TLSH
T1D9868D1173D84535F1B316319A7992645A7ABCA59F32CACF33882D5E6F70AC08A36733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects executables manipulated with Fody
AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12867

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\w32.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject FreeLibrary CreateProcessW GetCurrentProcess WaitForSingleObject GenerateConsoleCtrlEvent AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar CreateJobObjectA GetStdHandle GetLastError GetProcAddress LoadLibraryA SetConsoleCtrlHandler DuplicateHandle CloseHandle GetProcessHeap SetEndOfFile HeapReAlloc SetEnvironmentVariableW GetModuleHandleW DecodePointer HeapFree HeapAlloc GetStringTypeW GetCommandLineA HeapSetInformation GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount EncodePointer RtlUnwind DeleteCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW ReadFile SetHandleCount GetFileType SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep CreateFileW HeapSize GetConsoleCP GetConsoleMode SetStdHandle IsProcessorFeaturePresent FlushFileBuffers CompareStringW WriteConsoleW

shlwapi

StrStrIW PathRemoveFileSpecW PathCombineW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-04_e06cafdaa70c040b54dd439ce465f832_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc

kernel32

shlwapi

generic