General
- Target 2026-08-10_cc03332b7ddfc786227a2bb74b9dbfba_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_tofsee
- Size 7.0MB
- Sample260810-r9k99s1dph
- SHA256 1e6f421b4d5978f5d6925e3e727ef0b2472436898d0f7f9f5f679d54d0329e7d
- MD5 cc03332b7ddfc786227a2bb74b9dbfba
- SHA1 6d6aaf139ace94c2a6543c76cc10ca5936251984
- SHA512 94c9a89696cded7573091a1a09ce2a4c8cc6c8803114d40d98ac311d5b51cee1a6612b95d9e74410d617d1d080b0182390a35e1bd405c2a94ce94afe60b496de
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUx3r:equFIF0wuPlCKrjRv3r
- TLSH T1A4769E1273D84075F5B3163199759229567ABCA58E33CA8F328C2D5E6FB16C08E3A733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-10_cc03332b7ddfc786227a2bb74b9dbfba_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_cc03332b7ddfc786227a2bb74b9dbfba_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_cc03332b7ddfc786227a2bb74b9dbfba_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_tofsee
- Size 7.0MB
- SHA256 1e6f421b4d5978f5d6925e3e727ef0b2472436898d0f7f9f5f679d54d0329e7d
- MD5 cc03332b7ddfc786227a2bb74b9dbfba
- SHA1 6d6aaf139ace94c2a6543c76cc10ca5936251984
- SHA512 94c9a89696cded7573091a1a09ce2a4c8cc6c8803114d40d98ac311d5b51cee1a6612b95d9e74410d617d1d080b0182390a35e1bd405c2a94ce94afe60b496de
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUx3r:equFIF0wuPlCKrjRv3r
- TLSH T1A4769E1273D84075F5B3163199759229567ABCA58E33CA8F328C2D5E6FB16C08E3A733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.