6e0c0ca3538302b09b5293e88ee0284b74eaad9550d3b9292196dda76a89a38e

General

Target
2026-07-09_1a3e2c75aadb014ce6eba59dc9a4c0b2_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_rugmi_satacom_smoke-loader_stop_vidar
Size 8.5MB
Sample260709-kwxb2sgw2x
SHA256 6e0c0ca3538302b09b5293e88ee0284b74eaad9550d3b9292196dda76a89a38e
MD5 1a3e2c75aadb014ce6eba59dc9a4c0b2
SHA1 0729127a09bb82b76317d44b476ec6d6a0aad1f2
SHA512 6b17811044decdcc4746f766bff06e4949278d325071b0e6131d2cb0459980c6c198afdd76c683a1e0d56fede879443da980388cead09b2be989b8cb0ac48229
SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUljaRjYcGvJbLZ1opDbI:equFIF0wuPlCKrjRDaRjqvJbLZ7pjHv
TLSH
T11E96AE1272D84035F5B312329A3592656A3DBC655F32CA9F33C82D5E7FB16809A3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-09_1a3e2c75aadb014ce6eba59dc9a4c0b2_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_rugmi_satacom_smoke-loader_stop_vidar
- Size 8.5MB
- SHA256 6e0c0ca3538302b09b5293e88ee0284b74eaad9550d3b9292196dda76a89a38e
- MD5 1a3e2c75aadb014ce6eba59dc9a4c0b2
- SHA1 0729127a09bb82b76317d44b476ec6d6a0aad1f2
- SHA512 6b17811044decdcc4746f766bff06e4949278d325071b0e6131d2cb0459980c6c198afdd76c683a1e0d56fede879443da980388cead09b2be989b8cb0ac48229
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUljaRjYcGvJbLZ1opDbI:equFIF0wuPlCKrjRDaRjqvJbLZ7pjHv
- TLSH
  T11E96AE1272D84035F5B312329A3592656A3DBC655F32CA9F33C82D5E7FB16809A3A733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

ransomware spyware stealer adware persistence
- Detects executables manipulated with Fody
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2