General
- Target 2026-07-04_d87745a683d960582d6644b7dff81d02_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_vidar_wannacry
- Size 6.9MB
- Sample260704-vq3a8aav2v
- SHA256 da9346066a3e2406d934418bead87aab486648be0e509cae5b3e96df0c6b9259
- MD5 d87745a683d960582d6644b7dff81d02
- SHA1 4c068e6dbc3349459afe730b37093282cca5d1f0
- SHA512 ddb6211869263d4f75b3bf3043433757b0f47be00eda080061daebc412cb6e7dbb8e8b3cc4c106352d7d17f805799c3c07e9ad411bdc076658edce61d310f800
- SSDEEP 98304:uKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUQ5nF:uquFIF0wuPlCKrjRaF
- TLSH T1D7769E1273D44135F5B316318A3592595A7ABCA58F33CA8F338C2D9E6FB16808A39737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-04_d87745a683d960582d6644b7dff81d02_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-04_d87745a683d960582d6644b7dff81d02_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win11ltsc2024-20260629-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-04_d87745a683d960582d6644b7dff81d02_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_vidar_wannacry
- Size 6.9MB
- SHA256 da9346066a3e2406d934418bead87aab486648be0e509cae5b3e96df0c6b9259
- MD5 d87745a683d960582d6644b7dff81d02
- SHA1 4c068e6dbc3349459afe730b37093282cca5d1f0
- SHA512 ddb6211869263d4f75b3bf3043433757b0f47be00eda080061daebc412cb6e7dbb8e8b3cc4c106352d7d17f805799c3c07e9ad411bdc076658edce61d310f800
- SSDEEP 98304:uKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUQ5nF:uquFIF0wuPlCKrjRaF
- TLSH T1D7769E1273D44135F5B316318A3592595A7ABCA58F33CA8F338C2D9E6FB16808A39737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.