db5f3bf95e1f1bd5dd980ba91b909b88393d259795a882b5554b872907b76de9

General

Target
2026-08-14_0e4c19b296c875a2cd3a36c37aebe104_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_valleyrat_vidar
Size 27.3MB
Sample260814-rn6dbawamb
SHA256 db5f3bf95e1f1bd5dd980ba91b909b88393d259795a882b5554b872907b76de9
MD5 0e4c19b296c875a2cd3a36c37aebe104
SHA1 3b0fb33987be6656c73fac22796bbc95567d3ef6
SHA512 45bda4b921c8de2e886c204c8a46b10cb8df88ccdb3b572ece0e601450cfbdc982ffd2522a18df3348d450690d68644fe126c8b850bf2015ce96248311c89bcc
SSDEEP 196608:equFIF0wuPlCK1nSmkquFIF0wuPlCK1nSm6I7APhNNECwHrc8u3x3AEcq/fByuKO:/oUOtoUOdahvQHrc8u3xXJ/f4uUWH36a
TLSH
T1F257BF13738580B5D06692748A278216D779BC5443329BCF32987AAD7FB3BD09B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-14_0e4c19b296c875a2cd3a36c37aebe104_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_valleyrat_vidar
- Size 27.3MB
- SHA256 db5f3bf95e1f1bd5dd980ba91b909b88393d259795a882b5554b872907b76de9
- MD5 0e4c19b296c875a2cd3a36c37aebe104
- SHA1 3b0fb33987be6656c73fac22796bbc95567d3ef6
- SHA512 45bda4b921c8de2e886c204c8a46b10cb8df88ccdb3b572ece0e601450cfbdc982ffd2522a18df3348d450690d68644fe126c8b850bf2015ce96248311c89bcc
- SSDEEP 196608:equFIF0wuPlCK1nSmkquFIF0wuPlCK1nSm6I7APhNNECwHrc8u3x3AEcq/fByuKO:/oUOtoUOdahvQHrc8u3xXJ/f4uUWH36a
- TLSH
  T1F257BF13738580B5D06692748A278216D779BC5443329BCF32987AAD7FB3BD09B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

ransomware spyware stealer
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Detects executables manipulated with Fody
- Detects executables packed with Dotfuscator
- Detects executables packed with SmartAssembly
- Detects executables packed with Yano Obfuscator
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2