General
- Target 2026-07-06_d3df8659fdd889183a11356d04f6f86e_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_vidar
- Size 7.1MB
- Sample260706-yl7xpacy3s
- SHA256 ef14276346558d0bfb34a1aceda2317e80ae9c6bc2792582e16360bcb44a4a5e
Score
10/10
Malware Config
Targets
-
- Target 2026-07-06_d3df8659fdd889183a11356d04f6f86e_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_vidar
- Size 7.1MB
- SHA256 ef14276346558d0bfb34a1aceda2317e80ae9c6bc2792582e16360bcb44a4a5e
Score9/10- Custom signature
Detects executables manipulated with Fody
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
AutoIT Executable
AutoIT scripts compiled to PE executables.