2026-08-02_c81f0fd25ca72037a7f9d3a172ba4e25_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_tofsee

General

Target
2026-08-02_c81f0fd25ca72037a7f9d3a172ba4e25_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_tofsee
Size 22.5MB
Sample260802-3phjesgr9t
SHA256 94fbd73eadba88b3360a3a457a64bd77135bc5b661b3d131f5bbfcc9ae18c1cb
MD5 c81f0fd25ca72037a7f9d3a172ba4e25
SHA1 8f30f5e263a523a788bca3be2ac20dabf50c7aa3
SHA512 ce5ee7cb9e79e3d57621fef4fa73fcb24aa952f9e04a43a2fc4d01e55e59a267af931524f46603651b0828c49b8582cdab4180854276e8a0b08a569aa1edaa27
SSDEEP 196608:+TOdquFIF0wuPlCKrjRZTOdquFIF0wuPlCKrjRZTOdquFIF0wuPlCKrjRZTO7:+/oUmr/oUmr/oUmr6
TLSH
T12E37AE0276DC6875F1B316314A3592A55A39FCA54E32C98F33883E5E7B706C1AA39733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-02_c81f0fd25ca72037a7f9d3a172ba4e25_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_tofsee

File Explorer

2026-08-02_c81f0fd25ca72037a7f9d3a172ba4e25_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_tofsee

.exe 22.5MB

2026-08-02_c81f0fd25ca72037a7f9d3a172ba4e25_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_tofsee

IMPHASH 2655fc544bcc2d750b74d9eab3b31a22
SHA256 94fbd73eadba88b3360a3a457a64bd77135bc5b661b3d131f5bbfcc9ae18c1cb
MD5 c81f0fd25ca72037a7f9d3a172ba4e25
SHA1 8f30f5e263a523a788bca3be2ac20dabf50c7aa3
SHA512 ce5ee7cb9e79e3d57621fef4fa73fcb24aa952f9e04a43a2fc4d01e55e59a267af931524f46603651b0828c49b8582cdab4180854276e8a0b08a569aa1edaa27
SSDEEP 196608:+TOdquFIF0wuPlCKrjRZTOdquFIF0wuPlCKrjRZTOdquFIF0wuPlCKrjRZTO7:+/oUmr/oUmr/oUmr6
TLSH
T12E37AE0276DC6875F1B316314A3592A55A39FCA54E32C98F33883E5E7B706C1AA39733
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables manipulated with Fody
AutoIT Executable

AutoIT scripts compiled to PE executables.
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

2c:49:b6:67:48:7d:c9:59:86:b4:5d:f0:de:d6:42:63:e7:41:af:79:17:8c:ff:a1:3c:6c:ff:f1:76:3b:08:a2

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

Chains

May 17, 2022

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

Serial Number

07:1f:14:1b:8b:30:0d:25:f3:14:eb:23:0c:d0:d1:dd

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 17, 2022 - Jan 15, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Minor OS version

0

Major OS version

6

Entry point

4944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\_w\1\b\bin\amd64\pythonw.pdb

2026-08-02_c81f0fd25ca72037a7f9d3a172ba4e25_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_tofsee

PE Signature issue

python39

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_c81f0fd25ca72037a7f9d3a172ba4e25_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_tofsee

PE Signature issue

python39

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

generic