General
- Target 2026-08-04_ca01eaacec4c80363705e0ee317dbafb_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawkeye_remcos_rhadamanthys_satacom_smoke-loader_stealc_vidar
- Size 13.6MB
- Sample260805-alflfaag86
- SHA256 d2f3c18c30662097980d89f2bbf41137781650a87e5bb913f2fe074a7dbe7396
- MD5 ca01eaacec4c80363705e0ee317dbafb
- SHA1 d21720c9295a3949bd92ea164eb5751eb0ae8982
- SHA512 e3037d053d121b9b7288f987b40c620046563bda647b2771ee851ad9319c6ba7f8610aaaa4978236e317147b3866272d48c9380272b86597f7bba88774f6f793
- SSDEEP 98304:BllR35B2cPK8xl1MbQ9yDAD7KjPllR35B2cPK8xl1MbQ9yDAD7Kj91/tr37wj://35YCK+1tIDewd/35YCK+1tIDewp+
- TLSH T14AE68D1653B840A5E56BD179CA6AD533FBB13C090330A79F06A1CA2B2F777A06E3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-04_ca01eaacec4c80363705e0ee317dbafb_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawke.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_ca01eaacec4c80363705e0ee317dbafb_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawke.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_ca01eaacec4c80363705e0ee317dbafb_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawkeye_remcos_rhadamanthys_satacom_smoke-loader_stealc_vidar
- Size 13.6MB
- SHA256 d2f3c18c30662097980d89f2bbf41137781650a87e5bb913f2fe074a7dbe7396
- MD5 ca01eaacec4c80363705e0ee317dbafb
- SHA1 d21720c9295a3949bd92ea164eb5751eb0ae8982
- SHA512 e3037d053d121b9b7288f987b40c620046563bda647b2771ee851ad9319c6ba7f8610aaaa4978236e317147b3866272d48c9380272b86597f7bba88774f6f793
- SSDEEP 98304:BllR35B2cPK8xl1MbQ9yDAD7KjPllR35B2cPK8xl1MbQ9yDAD7Kj91/tr37wj://35YCK+1tIDewd/35YCK+1tIDewp+
- TLSH T14AE68D1653B840A5E56BD179CA6AD533FBB13C090330A79F06A1CA2B2F777A06E3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.