2026-07-07_6c9f0762d64bf541f64b0c6c175ccdbd_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_maze_njrat_remcos_rhadamanthys_smoke-loader

General

Target
2026-07-07_6c9f0762d64bf541f64b0c6c175ccdbd_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_maze_njrat_remcos_rhadamanthys_smoke-loader
Size 1.6MB
Sample260707-252fssgv4j
SHA256 4c8d4a3d68119bc7fc99479b71a7ec909c182d9b33d9328ad2f6cbeb43cb6145
MD5 6c9f0762d64bf541f64b0c6c175ccdbd
SHA1 c8415211d6530e94f1c98a004e7782196c8ae49c
SHA512 b3bfeb67dcbc5ca11e3c369c77ebc6d5c52d0dec27b2f0c855fe15430cf0293af986fc8372785a632d856bfe534897db16d34f053f8d766e49a61bff4bce06b2
SSDEEP 24576:W5+t0pOdR4aewsAjmr3YgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:teOD7ljmb37+KSbq5e1diEnHaCK
TLSH
T166859E13B7A0C022EE6725320B6EE716967CBD290713555F53BC1E79A9306F0273EA72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-07_6c9f0762d64bf541f64b0c6c175ccdbd_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_maze_njrat_remcos_rhadamanthys_smoke-loader

File Explorer

2026-07-07_6c9f0762d64bf541f64b0c6c175ccdbd_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_maze_njrat_remcos_rhadamanthys_smoke-loader

.exe 1.6MB

2026-07-07_6c9f0762d64bf541f64b0c6c175ccdbd_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_maze_njrat_remcos_rhadamanthys_smoke-loader

IMPHASH 92f377bec2fd08bb16ed274dff1cdbcc
SHA256 4c8d4a3d68119bc7fc99479b71a7ec909c182d9b33d9328ad2f6cbeb43cb6145
MD5 6c9f0762d64bf541f64b0c6c175ccdbd
SHA1 c8415211d6530e94f1c98a004e7782196c8ae49c
SHA512 b3bfeb67dcbc5ca11e3c369c77ebc6d5c52d0dec27b2f0c855fe15430cf0293af986fc8372785a632d856bfe534897db16d34f053f8d766e49a61bff4bce06b2
SSDEEP 24576:W5+t0pOdR4aewsAjmr3YgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:teOD7ljmb37+KSbq5e1diEnHaCK
TLSH
T166859E13B7A0C022EE6725320B6EE716967CBD290713555F53BC1E79A9306F0273EA72
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

61171

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\ipc\app\plugin-container.pdb

kernel32

InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeleteCriticalSection WaitForSingleObject Sleep RaiseException IsDebuggerPresent GetCurrentThreadId CloseHandle TlsGetValue TlsSetValue TlsAlloc TlsFree QueryPerformanceCounter GetSystemTimeAsFileTime QueryPerformanceFrequency GetNativeSystemInfo GetVersionExW GetModuleFileNameW SetHandleInformation VirtualFree GetProcessHandleCount GetCurrentProcessId FreeLibrary HeapSetInformation GetCurrentDirectoryW GetFileType SignalObjectAndWait CreateFileW WriteConsoleW SetStdHandle SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetModuleHandleExW SetLastError GetVolumeInformationW LocalFree GetLastError GetSystemDirectoryW GetComputerNameW TerminateProcess ExpandEnvironmentStringsW LoadLibraryExA GetModuleHandleA VirtualAllocEx VirtualProtectEx GetProcAddress VerifyVersionInfoW FlushInstructionCache GetModuleHandleW SetEnvironmentVariableW GetCurrentProcess VerSetConditionMask SetDllDirectoryW GetEnvironmentVariableW ReleaseActCtx MultiByteToWideChar CreateActCtxW VirtualQuery GetCommandLineW HeapFree EncodePointer DecodePointer HeapAlloc HeapReAlloc IsProcessorFeaturePresent LoadLibraryExW ExitProcess WideCharToMultiByte GetProcessHeap GetStdHandle GetStartupInfoW WriteFile GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW RtlUnwind OutputDebugStringW

winmm

timeGetTime

advapi32

RegCloseKey RegOpenKeyExW RevertToSelf RegDisablePredefinedCache GetLengthSid OpenProcessToken ConvertStringSidToSidW SetTokenInformation ConvertSidToStringSidW LookupAccountNameW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-07_6c9f0762d64bf541f64b0c6c175ccdbd_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_maze_njrat_remcos_rhadamanthys_smoke-loader

kernel32

winmm

advapi32

generic