General
- Target 2026-07-05_bf168951eb7cf4478581b6bc2163a06c_agent-tesla_amadey_blankgrabber_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_vidar
- Size 27.6MB
- Sample260705-d3cgwsg13s
- SHA256 1b74fcf3558e37947eeb0f9aaef3d466828ba8cb95b3ea9d90becbc2932bf533
- MD5 bf168951eb7cf4478581b6bc2163a06c
- SHA1 1a9e6340707f3116ad6bc1524a4d31ca17921e30
- SHA512 60624aa68532d1e19529867c029f9c28296b5a47522ea6d98b0033eb463f984f1ecf29bf55316201eb91a79382e8256088570062821be1eacbfe01472e09150f
- SSDEEP 196608:5SvTOXquFIF0wuPlCKrjRJSvTOXquFIF0wuPlCKrjRJSvTOXquFIF0wuPlCKrjR2:cZoUmOZoUmOZoUmOr
- TLSH T1F3578E0272DC68B5F0B311318B3592A55B39FC655B22CA8F33983E5D6F71681BA29733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-05_bf168951eb7cf4478581b6bc2163a06c_agent-tesla_amadey_blankgrabber_cobalt-strike_darkgate_g.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_bf168951eb7cf4478581b6bc2163a06c_agent-tesla_amadey_blankgrabber_cobalt-strike_darkgate_g.exe
Resource
win11ltsc2024-20260629-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-05_bf168951eb7cf4478581b6bc2163a06c_agent-tesla_amadey_blankgrabber_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop_vidar
- Size 27.6MB
- SHA256 1b74fcf3558e37947eeb0f9aaef3d466828ba8cb95b3ea9d90becbc2932bf533
- MD5 bf168951eb7cf4478581b6bc2163a06c
- SHA1 1a9e6340707f3116ad6bc1524a4d31ca17921e30
- SHA512 60624aa68532d1e19529867c029f9c28296b5a47522ea6d98b0033eb463f984f1ecf29bf55316201eb91a79382e8256088570062821be1eacbfe01472e09150f
- SSDEEP 196608:5SvTOXquFIF0wuPlCKrjRJSvTOXquFIF0wuPlCKrjRJSvTOXquFIF0wuPlCKrjR2:cZoUmOZoUmOZoUmOr
- TLSH T1F3578E0272DC68B5F0B311318B3592A55B39FC655B22CA8F33983E5D6F71681BA29733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.