2026-07-06_088cd01acf6f74197ba3ec4c1add0e69_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-07-06_088cd01acf6f74197ba3ec4c1add0e69_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
Size 25.7MB
Sample260707-gbbcasax71
SHA256 6ef095d73b4ed828047da256abd8ca07e36d5ce3e912d49cdcaa8df476b0648b
MD5 088cd01acf6f74197ba3ec4c1add0e69
SHA1 ac8bbff0ac9fbc5c458638e2fd76f12c2ed795e3
SHA512 5d4b771b25b7efe13f683b6973af6ec97b06e5d97b5f2459d91c3a2bfa10da27c863fb66b438d303dab2baf4a31d3278ac7caf1ea63b5c8d5ab754d8447fc923
SSDEEP 196608:abquFIF0wuPlCKrjRh1yxmO8bquFIF0wuPlCKrjRh1yxmO8bquFIF0wuPlCKrjRP:1oUmFyxzvoUmFyxzvoUmFyxzg
TLSH
T131478D1273D85535F1B71631997892645A3ABCA59F32CACF33882D5E6F70AC08A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_088cd01acf6f74197ba3ec4c1add0e69_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-07-06_088cd01acf6f74197ba3ec4c1add0e69_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

.exe 25.7MB

2026-07-06_088cd01acf6f74197ba3ec4c1add0e69_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

IMPHASH af457a899dff0be8f96c758b66fd5f37
SHA256 6ef095d73b4ed828047da256abd8ca07e36d5ce3e912d49cdcaa8df476b0648b
MD5 088cd01acf6f74197ba3ec4c1add0e69
SHA1 ac8bbff0ac9fbc5c458638e2fd76f12c2ed795e3
SHA512 5d4b771b25b7efe13f683b6973af6ec97b06e5d97b5f2459d91c3a2bfa10da27c863fb66b438d303dab2baf4a31d3278ac7caf1ea63b5c8d5ab754d8447fc923
SSDEEP 196608:abquFIF0wuPlCKrjRh1yxmO8bquFIF0wuPlCKrjRh1yxmO8bquFIF0wuPlCKrjRP:1oUmFyxzvoUmFyxzvoUmFyxzg
TLSH
T131478D1273D85535F1B71631997892645A3ABCA59F32CACF33882D5E6F70AC08A36733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects executables manipulated with Fody
AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15945

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\w32.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject FreeLibrary CreateProcessW SetHandleInformation WaitForSingleObjectEx AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar GetStartupInfoW GetTempPathW CreateJobObjectA GetStdHandle GetLastError GetProcAddress SetStdHandle LoadLibraryA GetFileType SetConsoleCtrlHandler SetCurrentDirectoryW CloseHandle GetProcessHeap SetEndOfFile SetEnvironmentVariableW CompareStringW IsProcessorFeaturePresent FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc GetModuleHandleW DecodePointer HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount GetCommandLineA HeapSetInformation RtlUnwind DeleteCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount Sleep LCMapStringW ReadFile SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime CreateFileW HeapSize WriteConsoleW

user32

PostMessageW WaitForInputIdle PeekMessageW CreateWindowExW GetMessageW DestroyWindow

shlwapi

PathCombineW StrStrIW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_088cd01acf6f74197ba3ec4c1add0e69_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

shlwapi

generic