2026-07-20_e676391c2ddc99c1f4adb06960a4de4d_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader

General

Target
2026-07-20_e676391c2ddc99c1f4adb06960a4de4d_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader
Size 7.8MB
Sample260720-y526jsd13n
SHA256 a61dae0a79f2879f9fa56fe4a5228d8ca7bd5cace40af101773b5fada13e8c1c
MD5 e676391c2ddc99c1f4adb06960a4de4d
SHA1 6daed41fc288b99a02c801705363c52bc6ba6575
SHA512 befa1a512a7569a172c74a95658d1bc661005a300dcc43059d5c870ee78cb5c2ff6b2eba7c410e0806e5c3b3fb02da9474a8663825eaa91f51223b30267711d7
SSDEEP 98304:9KRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUx8K:9quFIF0wuPlCKrjRvp
TLSH
T1B086AE0273D85475F1B316318A769658673ABCA58B32CA8F33882D5DAF716C09E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-20_e676391c2ddc99c1f4adb06960a4de4d_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader

File Explorer

2026-07-20_e676391c2ddc99c1f4adb06960a4de4d_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader

.exe 7.8MB

2026-07-20_e676391c2ddc99c1f4adb06960a4de4d_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader

IMPHASH f0ea749f47650b36d9712c2c487f984b
SHA256 a61dae0a79f2879f9fa56fe4a5228d8ca7bd5cace40af101773b5fada13e8c1c
MD5 e676391c2ddc99c1f4adb06960a4de4d
SHA1 6daed41fc288b99a02c801705363c52bc6ba6575
SHA512 befa1a512a7569a172c74a95658d1bc661005a300dcc43059d5c870ee78cb5c2ff6b2eba7c410e0806e5c3b3fb02da9474a8663825eaa91f51223b30267711d7
SSDEEP 98304:9KRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUx8K:9quFIF0wuPlCKrjRvp
TLSH
T1B086AE0273D85475F1B316318A769658673ABCA58B32CA8F33882D5DAF716C09E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables manipulated with Fody
AutoIT Executable

AutoIT scripts compiled to PE executables.
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

5d:bc:89:83:ae:5c:44:35:27:22:e9:ce:59:e4:a7:fe:40:ed:b2:b2:46:f9:ae:c2:81:d9:4b:c4:ac:25:0f:64

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

Chains

May 17, 2022

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

Serial Number

07:1f:14:1b:8b:30:0d:25:f3:14:eb:23:0c:d0:d1:dd

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 17, 2022 - Jan 15, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Minor OS version

0

Major OS version

6

Entry point

4948

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\_w\1\b\bin\amd64\python.pdb

2026-07-20_e676391c2ddc99c1f4adb06960a4de4d_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader

PE Signature issue

python39

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_e676391c2ddc99c1f4adb06960a4de4d_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader

PE Signature issue

python39

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

generic