General
- Target 2026-07-07_c6ca43bf13c797315e2f5253a26263c8_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
- Size 18.1MB
- Sample260707-p36xaafs8r
- SHA256 816e9ef1a64ce4ae255e3525d06bc0aeb1ed5a4c0a7c2c021d230014285aa0a1
- MD5 c6ca43bf13c797315e2f5253a26263c8
- SHA1 81f554de26b8031422032856683c4992f0907e99
- SHA512 ed9d572ae43bc3ad34bf5bb1a815019d0dc85592e1c638cdd5ce766444cacd7a7838548897938f2c2ba0e5ca83e5a7fd343d5b5a1e4e47e5a63687eeb6f71dbf
- SSDEEP 196608:AquFIF0wuPlCKrjRvGWquFIF0wuPlCK8quFIF0wuPlCKrjRvGl:ZoUm1EoUqoUm14
- TLSH T179179E1277D48035F5B316318A7592295A79BCA58A33C99F338C2D9E6FB16C08E39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-07_c6ca43bf13c797315e2f5253a26263c8_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_ele.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_c6ca43bf13c797315e2f5253a26263c8_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_ele.exe
Resource
win11ltsc2024-20260706-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-07_c6ca43bf13c797315e2f5253a26263c8_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_karagany_luca-stealer_lynx_njrat_play_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
- Size 18.1MB
- SHA256 816e9ef1a64ce4ae255e3525d06bc0aeb1ed5a4c0a7c2c021d230014285aa0a1
- MD5 c6ca43bf13c797315e2f5253a26263c8
- SHA1 81f554de26b8031422032856683c4992f0907e99
- SHA512 ed9d572ae43bc3ad34bf5bb1a815019d0dc85592e1c638cdd5ce766444cacd7a7838548897938f2c2ba0e5ca83e5a7fd343d5b5a1e4e47e5a63687eeb6f71dbf
- SSDEEP 196608:AquFIF0wuPlCKrjRvGWquFIF0wuPlCK8quFIF0wuPlCKrjRvGl:ZoUm1EoUqoUm14
- TLSH T179179E1277D48035F5B316318A7592295A79BCA58A33C99F338C2D9E6FB16C08E39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.