General
- Target 2026-08-10_d1c72b18432efb9d64d18941f69fa3c7_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_tofsee_vidar
- Size 7.0MB
- Sample260810-lkpnhazzb1
- SHA256 da3bf46dfb6b2795162cb55ccb5ad5a91a3a8aca201efa4ad3dc01cc29ecc9d8
- MD5 d1c72b18432efb9d64d18941f69fa3c7
- SHA1 d5653e658eeaa9da7bfa3d8e35b4b7992b653a4d
- SHA512 9fead0397854735263c0d86b9f846d70f730d3f47f2f7cbb1cfc34c0d32f0b66399d63cf9d444e620c80cd0ca7f7d7f1cdb42b49f54c287b5d0eb117b513e7a1
- SSDEEP 98304:uKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUxNNUB4:uquFIF0wuPlCKrjRvNGu
- TLSH T106769E1273D84475F1B31631893592695A7ABCA58F32CA8F338C2D9E7F716808A39737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-10_d1c72b18432efb9d64d18941f69fa3c7_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_d1c72b18432efb9d64d18941f69fa3c7_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_d1c72b18432efb9d64d18941f69fa3c7_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stealc_tofsee_vidar
- Size 7.0MB
- SHA256 da3bf46dfb6b2795162cb55ccb5ad5a91a3a8aca201efa4ad3dc01cc29ecc9d8
- MD5 d1c72b18432efb9d64d18941f69fa3c7
- SHA1 d5653e658eeaa9da7bfa3d8e35b4b7992b653a4d
- SHA512 9fead0397854735263c0d86b9f846d70f730d3f47f2f7cbb1cfc34c0d32f0b66399d63cf9d444e620c80cd0ca7f7d7f1cdb42b49f54c287b5d0eb117b513e7a1
- SSDEEP 98304:uKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUxNNUB4:uquFIF0wuPlCKrjRvNGu
- TLSH T106769E1273D84475F1B31631893592695A7ABCA58F32CA8F338C2D9E7F716808A39737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.