General
- Target 2026-08-09_93b1df2eeeef286cb592ddbc82704ebc_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_lynx_njrat_play_remcos_smoke-loader
- Size 10.8MB
- Sample260809-yeemkacb55
- SHA256 9b36c8e273f778b293d9725c8d8f3e865162e34361a5abd64068b4188e696675
- MD5 93b1df2eeeef286cb592ddbc82704ebc
- SHA1 9bd18b1d61e6da62808c270e585cf2e09dedff50
- SHA512 5d6dd08c95313531f7c49a8b995beddacd4697513a380a7dee79192fa7b5bc09b516259e209df1093f1364cf656189945d80443b5e08595b58af96a091a3259f
- SSDEEP 98304:6KsW1+M5N/TOhCcKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUDKsWS:61y/TOAcquFIF0wuPlCKrjRh1y/TOAA
- TLSH T145B68C0177D86975F0B716319A7992A45A3BBC605F32C6CF32843E5E2B706C1AA35B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-09_93b1df2eeeef286cb592ddbc82704ebc_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_ele.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_93b1df2eeeef286cb592ddbc82704ebc_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_ele.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_93b1df2eeeef286cb592ddbc82704ebc_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_lynx_njrat_play_remcos_smoke-loader
- Size 10.8MB
- SHA256 9b36c8e273f778b293d9725c8d8f3e865162e34361a5abd64068b4188e696675
- MD5 93b1df2eeeef286cb592ddbc82704ebc
- SHA1 9bd18b1d61e6da62808c270e585cf2e09dedff50
- SHA512 5d6dd08c95313531f7c49a8b995beddacd4697513a380a7dee79192fa7b5bc09b516259e209df1093f1364cf656189945d80443b5e08595b58af96a091a3259f
- SSDEEP 98304:6KsW1+M5N/TOhCcKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUDKsWS:61y/TOAcquFIF0wuPlCKrjRh1y/TOAA
- TLSH T145B68C0177D86975F0B716319A7992A45A3BBC605F32C6CF32843E5E2B706C1AA35B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE