2026-07-06_9ec5e006fcf409b5d7a971a4d4ba16e2_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc

General

Target
2026-07-06_9ec5e006fcf409b5d7a971a4d4ba16e2_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc
Size 12.8MB
Sample260707-cdqsjsfx41
SHA256 3be116ae04f6ff8adfac658935e329a34bdda914f9c4ba536feaad26ec4bd996
MD5 9ec5e006fcf409b5d7a971a4d4ba16e2
SHA1 fa1db4847c6c4ac790806200a89cd124804b4ceb
SHA512 60d66f5834b78c22d4178d4d0c146f659d420d4f74a34d3d14585465f535d462917f78d38ba94b5ba20f736977cb9cba8033f3b097dd6c831fc795ed36506995
SSDEEP 196608:TquFIF0wuPlCK8quFIF0wuPlCKrjRvH1yn:+oUqoUm1Vyn
TLSH
T132D68E1277D54035F5B31631997992295A7ABC658F33CA8F33882D9E6FB06C08A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_9ec5e006fcf409b5d7a971a4d4ba16e2_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc

File Explorer

2026-07-06_9ec5e006fcf409b5d7a971a4d4ba16e2_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc

.exe 12.8MB

2026-07-06_9ec5e006fcf409b5d7a971a4d4ba16e2_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc

IMPHASH 6a4b44fbce292023be72ed865b6c8979
SHA256 3be116ae04f6ff8adfac658935e329a34bdda914f9c4ba536feaad26ec4bd996
MD5 9ec5e006fcf409b5d7a971a4d4ba16e2
SHA1 fa1db4847c6c4ac790806200a89cd124804b4ceb
SHA512 60d66f5834b78c22d4178d4d0c146f659d420d4f74a34d3d14585465f535d462917f78d38ba94b5ba20f736977cb9cba8033f3b097dd6c831fc795ed36506995
SSDEEP 196608:TquFIF0wuPlCK8quFIF0wuPlCKrjRvH1yn:+oUqoUm1Vyn
TLSH
T132D68E1277D54035F5B31631997992295A7ABC658F33CA8F33882D9E6FB06C08A36733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects executables manipulated with Fody
AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12867

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\w32.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject FreeLibrary CreateProcessW GetCurrentProcess WaitForSingleObject GenerateConsoleCtrlEvent AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar CreateJobObjectA GetStdHandle GetLastError GetProcAddress LoadLibraryA SetConsoleCtrlHandler DuplicateHandle CloseHandle GetProcessHeap SetEndOfFile HeapReAlloc SetEnvironmentVariableW GetModuleHandleW DecodePointer HeapFree HeapAlloc GetStringTypeW GetCommandLineA HeapSetInformation GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount EncodePointer RtlUnwind DeleteCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW ReadFile SetHandleCount GetFileType SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep CreateFileW HeapSize GetConsoleCP GetConsoleMode SetStdHandle IsProcessorFeaturePresent FlushFileBuffers CompareStringW WriteConsoleW

shlwapi

StrStrIW PathRemoveFileSpecW PathCombineW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_9ec5e006fcf409b5d7a971a4d4ba16e2_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc

kernel32

shlwapi

generic