2026-07-06_54f7bc1c248be28a4197324c600d7e41_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_54f7bc1c248be28a4197324c600d7e41_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stop
Size 27.4MB
Sample260707-ebe95shs4w
SHA256 b3557f64153be1dae20f14a18197e62636d280ac8c39ad22ae74fae30d782260
MD5 54f7bc1c248be28a4197324c600d7e41
SHA1 12d47764f1d4c6d6985c59675c93500d3337bf7f
SHA512 88e0b83763dfa29c3a6b32c85e7460cee57ac15aab94d2ad22e4b93ec32305f3fc7c6be7807581bcc4f7da87cf7de38d2092edda1877374eaade0785e41918e1
SSDEEP 196608:61yxmgquFIF0wuPlCKrjRh1yxmgquFIF0wuPlCKrjRh1yxmgquFIF0wuPlCKrjRs:syxuoUmFyxuoUmFyxuoUmFyxn
TLSH
T1D6577C1277D85535F1B71631997892645A3BBCA19F32CACF33882D5E6B70AC08A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-06_54f7bc1c248be28a4197324c600d7e41_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-06_54f7bc1c248be28a4197324c600d7e41_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

.exe 27.4MB

2026-07-06_54f7bc1c248be28a4197324c600d7e41_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

IMPHASH 5bf7e763ccf9c352a68ccdf335b6cd41
SHA256 b3557f64153be1dae20f14a18197e62636d280ac8c39ad22ae74fae30d782260
MD5 54f7bc1c248be28a4197324c600d7e41
SHA1 12d47764f1d4c6d6985c59675c93500d3337bf7f
SHA512 88e0b83763dfa29c3a6b32c85e7460cee57ac15aab94d2ad22e4b93ec32305f3fc7c6be7807581bcc4f7da87cf7de38d2092edda1877374eaade0785e41918e1
SSDEEP 196608:61yxmgquFIF0wuPlCKrjRh1yxmgquFIF0wuPlCKrjRh1yxmgquFIF0wuPlCKrjRs:syxuoUmFyxuoUmFyxuoUmFyxn
TLSH
T1D6577C1277D85535F1B71631997892645A3BBCA19F32CACF33882D5E6B70AC08A36733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects executables manipulated with Fody
AutoIT Executable

AutoIT scripts compiled to PE executables.
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

34:41:e0:c6:12:59:7c:c7:77:10:c4:4f:57:21:ba:0c:9b:8c:c7:52:28:4a:db:99:e0:d0:82:78:ec:ae:27:11

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 25, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:1a:34:0f:78:d7:d0:00:e0:89:fd:ba:ad:65:22:df

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 3, 2023 - Nov 4, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

441904

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARM.pdb

msi

ord114 ord16 ord120 ord123 ord205 ord159 ord160 ord141 ord8 ord118 ord171 ord92 ord116 ord115 ord119 ord88 ord240 ord131 ord150 ord78 ord70 ord181 ord195 ord32 ord281

psapi

GetModuleBaseNameW EnumProcessModules EnumProcesses GetModuleFileNameExW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

DeleteUrlCacheEntryW HttpQueryInfoW InternetReadFile InternetCrackUrlW InternetOpenW InternetConnectW HttpOpenRequestW HttpSendRequestW InternetErrorDlg InternetSetOptionW InternetCloseHandle

sensapi

IsNetworkAlive

secur32

LsaGetLogonSessionData LsaFreeReturnBuffer

kernel32

GlobalLock GlobalUnlock GlobalFree MulDiv FlushFileBuffers GetFullPathNameW LockFile UnlockFile DuplicateHandle LoadLibraryExW LoadLibraryA GetCurrentThreadId GetVersionExW FreeLibrary GlobalDeleteAtom SetThreadPriority SuspendThread ResumeThread GetPrivateProfileIntW GlobalAddAtomW EncodePointer GetSystemDirectoryW GlobalFindAtomW GetModuleHandleA FileTimeToLocalFileTime FindNextFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFileAttributesExW GetFileSizeEx GetFileTime InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalReAlloc SetErrorMode GetCurrentDirectoryW GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GlobalFlags GetUserDefaultLCID ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleFileNameW InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection OutputDebugStringA GetACP ExpandEnvironmentStringsW GetCurrentProcessId ProcessIdToSessionId GlobalMemoryStatusEx GetEnvironmentVariableW GetSystemInfo WideCharToMultiByte DeleteCriticalSection DecodePointer RaiseException InitializeCriticalSectionEx Module32NextW Module32FirstW GetNativeSystemInfo Process32NextW GetLongPathNameW Process32FirstW CreateToolhelp32Snapshot LoadLibraryW FindResourceExW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy lstrcmpA lstrcmpW LocalAlloc GetExitCodeProcess CreateProcessW GetFileInformationByHandle OpenMutexW CreateMutexW SystemTimeToFileTime SetEndOfFile RemoveDirectoryW GetFileSize SetFilePointer GetThreadLocale GetPrivateProfileSectionNamesW MoveFileW WaitNamedPipeW CreateNamedPipeW ConnectNamedPipe SetNamedPipeHandleState DisconnectNamedPipe ReadFile LocalFree GetUserDefaultLangID UnmapViewOfFile OpenFileMappingW MapViewOfFile FormatMessageW GetLocalTime GetModuleHandleW GetProcAddress GetVolumeInformationW GetPrivateProfileStringW WritePrivateProfileStringW MoveFileExW CreateFileW GetCurrentThread GetCurrentProcess OpenProcess CopyFileW GetTickCount64 GetTempPathW SetLastError WaitForSingleObject SetEvent OpenEventW CloseHandle CreateEventW Sleep GetThreadPriority MultiByteToWideChar FindClose FindFirstFileW DeleteFileW lstrlenW SetFileAttributesW SetFileTime WriteFile GetLastError GlobalAlloc CreateDirectoryW GetFileAttributesW FindResourceW LoadResource LockResource SizeofResource OutputDebugStringW GetStringTypeW LCMapStringW GetCPInfo RtlUnwind GetDriveTypeW SetEnvironmentVariableW SetCurrentDirectoryW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCommandLineA GetCommandLineW SetStdHandle GetFileType HeapQueryInformation GetStdHandle ExitProcess GetDateFormatW GetTimeFormatW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW CompareStringW

user32

DestroyMenu GetMonitorInfoW MonitorFromWindow WinHelpW UnhookWindowsHookEx GetTopWindow GetClassNameW GetClassLongW PtInRect MapWindowPoints AdjustWindowRectEx RemovePropW GetPropW SetPropW ShowScrollBar GetScrollPos RedrawWindow TrackPopupMenu SetMenu GetMenu GetCapture EndDeferWindowPos DeferWindowPos BeginDeferWindowPos IsChild IsMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos CopyRect GetSysColor ScreenToClient EndPaint BeginPaint ReleaseDC GetDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW GetDesktopWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamW IsDialogMessageW SetWindowLongW GetWindowTextLengthW SetFocus GetDlgCtrlID SetDlgItemTextW GetSysColorBrush ShowWindow GetLastActivePopup GetWindowLongW IsWindowEnabled LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem CallNextHookEx SetWindowsHookExW ValidateRect GetKeyState DispatchMessageW TranslateMessage GetMessageW PostQuitMessage CharUpperW GetMenuStringW OffsetRect SendDlgItemMessageA UnregisterClassW GetWindow FindWindowW ExitWindowsEx RegisterWindowMessageW RealChildWindowFromPoint InvalidateRect EnumWindows GetWindowTextW IsWindowVisible GetWindowThreadProcessId FindWindowExW SystemParametersInfoW SetActiveWindow DrawAnimatedRects SetForegroundWindow SetMenuDefaultItem ModifyMenuW GetMenuItemID GetMenuItemCount GetSubMenu ClientToScreen GetCursorPos LoadMenuW SetCursor DrawFocusRect InflateRect SetRectEmpty GetParent SetWindowTextW LoadCursorW GetActiveWindow DrawIcon GetClientRect GetSystemMetrics IsIconic PeekMessageW UpdateWindow GetFocus IsWindow SetTimer GetWindowRect SendMessageW LoadIconW EnableWindow PostMessageW SetWindowPos GetForegroundWindow KillTimer MessageBoxW GetDlgItem DestroyWindow

gdi32

ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx CreateBitmap GetDeviceCaps DeleteDC SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW SetTextColor GetTextExtentPoint32W CreateFontIndirectW GetObjectW SetMapMode SetBkMode SetBkColor SelectObject SaveDC RestoreDC RectVisible PtVisible GetStockObject GetClipBox Escape DeleteObject

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegEnumValueW RegCloseKey RegDeleteTreeW CopySid GetLengthSid IsValidSid GetSidSubAuthority InitializeSid GetSidLengthRequired OpenProcessToken RegQueryValueW RegEnumKeyW RegDeleteKeyW RegFlushKey ConvertSidToStringSidW LookupAccountNameW ControlService QueryServiceStatusEx CloseServiceHandle OpenServiceW OpenSCManagerW CreateWellKnownSid RegCreateKeyW RegDeleteKeyExW LookupAccountSidW GetTokenInformation DuplicateTokenEx CreateProcessAsUserW AdjustTokenPrivileges LookupPrivilegeValueW GetUserNameW RegCreateKeyExW RegQueryValueExW RegSetValueExW RegDeleteValueW ConvertStringSecurityDescriptorToSecurityDescriptorW CheckTokenMembership DuplicateToken OpenThreadToken

shell32

ShellExecuteW SHCreateDirectoryExW ShellExecuteExW SHFileOperationW Shell_NotifyIconW SHAppBarMessage SHGetFolderPathW

comctl32

_TrackMouseEvent InitCommonControlsEx

shlwapi

PathIsUNCW PathStripToRootW PathFindExtensionW PathFindFileNameW SHDeleteKeyW

ole32

CoInitialize CoUninitialize CoTaskMemFree CoInitializeEx CoInitializeSecurity CoCreateInstance OleRun CoCreateGuid

oleaut32

SysAllocString SysFreeString VariantClear SysAllocStringByteLen SysStringByteLen VariantInit VariantCopy VariantChangeType GetErrorInfo

urlmon

URLDownloadToFileW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock UnloadUserProfile

crypt32

CryptUnprotectData CryptProtectData CryptDecodeObject CryptMsgClose CertCloseStore CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptQueryObject CryptMsgGetParam

wintrust

WinVerifyTrust

oleacc

LresultFromObject CreateStdAccessibleObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_54f7bc1c248be28a4197324c600d7e41_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

PE Signature issue

msi

psapi

version

wininet

sensapi

secur32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

urlmon

userenv

crypt32

wintrust

oleacc

generic