General
- Target 2026-08-10_ed4f75d47bc0e72ad69440de1f1f4807_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stop
- Size 6.4MB
- Sample260810-vkja6ayvfv
- SHA256 8074da928baa69ef38fef2045a3bfe1eb0b4a2791c94e25a10c9b15e4b613aa4
- MD5 ed4f75d47bc0e72ad69440de1f1f4807
- SHA1 246511afb2f91189b3bc5c4e087459413051068c
- SHA512 ea0c76a84038c2de45f7769f03d3baab477d28e31613f5df239d317222588109e48213a2e8fb221cda4fc17a6d2e456e26dcfe6aee1b82ec0823b0dfcadd3caf
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUlN:equFIF0wuPlCKrjRt
- TLSH T1A166AE0273D84435F5B31631993592295A7ABCA58E33CA9F328C2D5E7FB16808E39737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-10_ed4f75d47bc0e72ad69440de1f1f4807_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_ed4f75d47bc0e72ad69440de1f1f4807_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_ed4f75d47bc0e72ad69440de1f1f4807_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_satacom_smoke-loader_stop
- Size 6.4MB
- SHA256 8074da928baa69ef38fef2045a3bfe1eb0b4a2791c94e25a10c9b15e4b613aa4
- MD5 ed4f75d47bc0e72ad69440de1f1f4807
- SHA1 246511afb2f91189b3bc5c4e087459413051068c
- SHA512 ea0c76a84038c2de45f7769f03d3baab477d28e31613f5df239d317222588109e48213a2e8fb221cda4fc17a6d2e456e26dcfe6aee1b82ec0823b0dfcadd3caf
- SSDEEP 98304:eKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUlN:equFIF0wuPlCKrjRt
- TLSH T1A166AE0273D84435F5B31631993592295A7ABCA58E33CA9F328C2D5E7FB16808E39737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.