General
- Target 2026-08-10_70c30a34d52297b7eb3fd100d1187a51_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_satacom_smoke-loader
- Size 7.3MB
- Sample260810-n8t91axhpd
- SHA256 842f0f443e10881882e0b4f8dbc02ac56b91dabedb2989c552c87b59b137051f
- MD5 70c30a34d52297b7eb3fd100d1187a51
- SHA1 ac98d448e742d9722fe5b42b141fd65851c835b6
- SHA512 9d0164792e6d18f3923f61868b2405d514b206612ac1c99c49f327928f082c53c7f651c21f904a4678214565f721dc2634012db113da268d8c67eeb97d370a51
- SSDEEP 98304:QKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUUyLZ1opDbSVHrjK:QquFIF0wuPlCKrjR1LZ7pjK
- TLSH T15976AE1276D84035F5B31631993592296A39BCA59F32CA9F338C2D5E7FB16C08A36733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-10_70c30a34d52297b7eb3fd100d1187a51_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_70c30a34d52297b7eb3fd100d1187a51_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glas.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_70c30a34d52297b7eb3fd100d1187a51_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_satacom_smoke-loader
- Size 7.3MB
- SHA256 842f0f443e10881882e0b4f8dbc02ac56b91dabedb2989c552c87b59b137051f
- MD5 70c30a34d52297b7eb3fd100d1187a51
- SHA1 ac98d448e742d9722fe5b42b141fd65851c835b6
- SHA512 9d0164792e6d18f3923f61868b2405d514b206612ac1c99c49f327928f082c53c7f651c21f904a4678214565f721dc2634012db113da268d8c67eeb97d370a51
- SSDEEP 98304:QKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUUyLZ1opDbSVHrjK:QquFIF0wuPlCKrjR1LZ7pjK
- TLSH T15976AE1276D84035F5B31631993592296A39BCA59F32CA9F338C2D5E7FB16C08A36733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.