General
- Target 2026-08-02_fda1431d9011234d349910418c19b6b6_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_hijackloader_remcos_rhadamanthys_smoke-loader_stop_vidar_wannacry
- Size 5.1MB
- Sample260802-3bvltshc33
- SHA256 feb1756845a770a86baec5300aa2b77d2a71c5a3c258baec0ba8f9190601adf0
- MD5 fda1431d9011234d349910418c19b6b6
- SHA1 283d3947b383351cfdabb358405c0972cca769c3
- SHA512 00ba0c89e93aab325bf7f794d98bd1ade3c2671802055e1410dd6090ee9e119b4b7878af599f8d548ca0e27ed51a1373dc1f583ced90fb834c234e787783dee0
- SSDEEP 49152:TuTl3EZpBh211Waw30zk1xH4eW4SkZP4sz9MbkqJtb2IdqJtb2IEeW4SkZP4sz9V:jr211Kn0fkZckcFfkZcBr0fkZc
- TLSH T160463B16F6788323E0B3D0BAC5D7AB99FA3238455B308ACB0245976C2E277D5C536736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-02_fda1431d9011234d349910418c19b6b6_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_fda1431d9011234d349910418c19b6b6_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_fda1431d9011234d349910418c19b6b6_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_hijackloader_remcos_rhadamanthys_smoke-loader_stop_vidar_wannacry
- Size 5.1MB
- SHA256 feb1756845a770a86baec5300aa2b77d2a71c5a3c258baec0ba8f9190601adf0
- MD5 fda1431d9011234d349910418c19b6b6
- SHA1 283d3947b383351cfdabb358405c0972cca769c3
- SHA512 00ba0c89e93aab325bf7f794d98bd1ade3c2671802055e1410dd6090ee9e119b4b7878af599f8d548ca0e27ed51a1373dc1f583ced90fb834c234e787783dee0
- SSDEEP 49152:TuTl3EZpBh211Waw30zk1xH4eW4SkZP4sz9MbkqJtb2IdqJtb2IEeW4SkZP4sz9V:jr211Kn0fkZckcFfkZcBr0fkZc
- TLSH T160463B16F6788323E0B3D0BAC5D7AB99FA3238455B308ACB0245976C2E277D5C536736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory