General
- Target 2026-07-04_e5b0ad56a9951bc68c9798cc17346755_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_satacom_smoke-loader
- Size 7.4MB
- Sample260704-vjexcaas61
- SHA256 48ff6cae3afbd643c21a1776137f8a75d35766dc37a616a21be1986bc44e6aa2
- MD5 e5b0ad56a9951bc68c9798cc17346755
- SHA1 507f36a243191679d1c3a9db84669759febd6399
- SHA512 c75e401820422bb0e1e10ed0675b46dfd0d5f08de0cdc82a4b41c7ae584add9fecd646c506f88a265dfc0b950d2dd145db48e7a23c3c9befcb238310fea7f31e
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUALBLZ1opDbSVHrj:equFIF0wuPlCKrjR+LZ7pj
- TLSH T11176AE1272D84035F5B316319A3592656A3DBCA59F33CA9F32883D5E7FB06809A36733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-04_e5b0ad56a9951bc68c9798cc17346755_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-04_e5b0ad56a9951bc68c9798cc17346755_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win11ltsc2024-20260629-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-04_e5b0ad56a9951bc68c9798cc17346755_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_satacom_smoke-loader
- Size 7.4MB
- SHA256 48ff6cae3afbd643c21a1776137f8a75d35766dc37a616a21be1986bc44e6aa2
- MD5 e5b0ad56a9951bc68c9798cc17346755
- SHA1 507f36a243191679d1c3a9db84669759febd6399
- SHA512 c75e401820422bb0e1e10ed0675b46dfd0d5f08de0cdc82a4b41c7ae584add9fecd646c506f88a265dfc0b950d2dd145db48e7a23c3c9befcb238310fea7f31e
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUALBLZ1opDbSVHrj:equFIF0wuPlCKrjR+LZ7pj
- TLSH T11176AE1272D84035F5B316319A3592656A3DBCA59F33CA9F32883D5E7FB06809A36733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.