General
- Target 2026-07-09_4b1bd9ebb6ca0099ec348986b9a1da75_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop
- Size 29.9MB
- Sample260709-1z5etsbs9v
- SHA256 9720d12223c8309ac7740f0698c1e42b4b8a7fbd0a10821c94446c3102c8a3fc
- MD5 4b1bd9ebb6ca0099ec348986b9a1da75
- SHA1 5221d5bb8a3a7c2a77848e3fa307280e500ad480
- SHA512 c647c7f4d7815a3579ed0ebbcb3178df2d4c97dd78e9816153727869a2ab84805fc96e429912c818703955ac0a509b93ac98a932eed272e7b2531ac3401939ba
- SSDEEP 196608:AquFIF0wuPlCKrjRc2quFIF0wuPlCK8quFIF0wuPlCKrjRc2quFIF0wuPlCK8quK:ZoUmcoUqoUmcoUqoUmO
- TLSH T160679E0277D44035F5B316318A7592695A79BCA58A33C99F338C2D9EAFB16C08E39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-09_4b1bd9ebb6ca0099ec348986b9a1da75_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_4b1bd9ebb6ca0099ec348986b9a1da75_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_4b1bd9ebb6ca0099ec348986b9a1da75_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stealc_stop
- Size 29.9MB
- SHA256 9720d12223c8309ac7740f0698c1e42b4b8a7fbd0a10821c94446c3102c8a3fc
- MD5 4b1bd9ebb6ca0099ec348986b9a1da75
- SHA1 5221d5bb8a3a7c2a77848e3fa307280e500ad480
- SHA512 c647c7f4d7815a3579ed0ebbcb3178df2d4c97dd78e9816153727869a2ab84805fc96e429912c818703955ac0a509b93ac98a932eed272e7b2531ac3401939ba
- SSDEEP 196608:AquFIF0wuPlCKrjRc2quFIF0wuPlCK8quFIF0wuPlCKrjRc2quFIF0wuPlCK8quK:ZoUmcoUqoUmcoUqoUmO
- TLSH T160679E0277D44035F5B316318A7592695A79BCA58A33C99F338C2D9EAFB16C08E39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.