2026-08-20_9203f727a886c21d2b4ec6f4d0ddd1ef_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_9203f727a886c21d2b4ec6f4d0ddd1ef_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_vidar
Size 39.5MB
Sample260820-3tkvcagd53
SHA256 475f42522cd1de6d90566ae01dd0794f9018467cf3de4e76ddda24e077dc8c7d
MD5 9203f727a886c21d2b4ec6f4d0ddd1ef
SHA1 c8904659f0a8bde69d49883e6633602059f879cb
SHA512 d492b4da4ec27c85525c137965ce94f89461d74a47d2ed82fc4a385b027699a20930331e4d2f503d94fd9588bdf54eee53bee2201496caf04d2367d98e75d464
SSDEEP 786432:rdEG7hGHq2Y9tZT5bP0LP0Ei/FSyEHq2Y9tZT5bP0LP0:OPjKT5bP0LP2Uy0jKT5bP0LP
TLSH
T1E5972302E7D155B2ED23053206567F12933EA4051B2298FBA7847F4E79B2FA2D779323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_9203f727a886c21d2b4ec6f4d0ddd1ef_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_vidar

File Explorer

2026-08-20_9203f727a886c21d2b4ec6f4d0ddd1ef_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_vidar

.exe 39.5MB

2026-08-20_9203f727a886c21d2b4ec6f4d0ddd1ef_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_vidar

IMPHASH 481bfdf21b71ab860c82402b111767dc
SHA256 475f42522cd1de6d90566ae01dd0794f9018467cf3de4e76ddda24e077dc8c7d
MD5 9203f727a886c21d2b4ec6f4d0ddd1ef
SHA1 c8904659f0a8bde69d49883e6633602059f879cb
SHA512 d492b4da4ec27c85525c137965ce94f89461d74a47d2ed82fc4a385b027699a20930331e4d2f503d94fd9588bdf54eee53bee2201496caf04d2367d98e75d464
SSDEEP 786432:rdEG7hGHq2Y9tZT5bP0LP0Ei/FSyEHq2Y9tZT5bP0LP0:OPjKT5bP0LP2Uy0jKT5bP0LP
TLSH
T1E5972302E7D155B2ED23053206567F12933EA4051B2298FBA7847F4E79B2FA2D779323
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables packed with VMProtect.
AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

774976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\desktop new\snake239v\snake239v\x64\Release\SNAKE BYPASS.pdb

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemory

kernel32

GetTickCount MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType WaitForMultipleObjects CreateFileA GetFileSizeEx MultiByteToWideChar ResetEvent CreateEventW GetModuleFileNameW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemDirectoryA SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW SleepEx SetLastError LocalFree GlobalAlloc GetProcessHeap DeleteCriticalSection HeapDestroy VerifyVersionInfoA LeaveCriticalSection FormatMessageA EnterCriticalSection HeapAlloc HeapReAlloc HeapSize InitializeCriticalSectionEx GetCurrentProcess HeapFree QueryPerformanceCounter VerifyVersionInfoW FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock lstrlenW WaitNamedPipeW GetCurrentProcessId GetLastError CreateFileW PeekNamedPipe WriteFile WideCharToMultiByte GlobalLock GlobalFree UnhandledExceptionFilter ReadFile ExitProcess CreateThread Sleep VirtualQueryEx ReadProcessMemory VirtualProtectEx LoadResource CloseHandle Process32Next LockResource K32GetProcessMemoryInfo CreateToolhelp32Snapshot OpenProcess WaitForSingleObject FindResourceA WriteProcessMemory Process32First SizeofResource GetModuleFileNameA SetEvent InitializeCriticalSectionAndSpinCount InitOnceBeginInitialize InitOnceComplete GetModuleHandleW

user32

PeekMessageA ReleaseCapture TranslateMessage DispatchMessageA GetDesktopWindow PostQuitMessage IsIconic SetCursorPos RegisterClassExA UnregisterClassA GetClientRect ReleaseDC GetCursorPos OpenClipboard SetWindowTextA DefWindowProcA SetWindowLongW SetCursor SetCapture BringWindowToTop SetFocus SetLayeredWindowAttributes CreateWindowExA CloseClipboard UpdateWindow GetWindowLongW AdjustWindowRectEx GetKeyState LoadCursorA DestroyWindow GetDC SetWindowPos MonitorFromWindow EnumDisplayMonitors ScreenToClient SetWindowTextW WindowFromPoint ShowWindow GetCapture GetForegroundWindow EmptyClipboard GetClipboardData SetClipboardData MessageBoxA GetMonitorInfoA IsChild ClientToScreen SetWindowLongA SetForegroundWindow

gdi32

GetDeviceCaps

advapi32

CryptReleaseContext CryptAcquireContextA DeleteService ControlService ConvertSidToStringSidA CopySid IsValidSid OpenProcessToken GetLengthSid GetTokenInformation RegCreateKeyExW RegSetValueExW RegCloseKey RegSetValueExA RegOpenKeyExA CreateServiceA CloseServiceHandle RegQueryValueExA OpenSCManagerA ChangeServiceConfigA StartServiceA RegOpenKeyExW QueryServiceStatusEx OpenServiceA CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt

shell32

ShellExecuteExA ShellExecuteA

msvcp140

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ _Query_perf_counter _Thrd_sleep _Query_perf_frequency ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z _Cnd_init_in_situ ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Throw_C_error@std@@YAXH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z _Mtx_destroy_in_situ ?__ExceptionPtrDestroy@@YAXPEAX@Z _Mtx_lock ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Mtx_init_in_situ _Cnd_register_at_thread_exit _Cnd_wait _Mtx_unlock _Cnd_broadcast _Cnd_destroy_in_situ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ _Mtx_current_owns ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_timedwait _Cnd_do_broadcast_at_thread_exit _Xtime_get_ticks ?uncaught_exception@std@@YA_NXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

normaliz

IdnToAscii

wldap32

ord41 ord50 ord45 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord22 ord60 ord211 ord46 ord217 ord26 ord143

crypt32

PFXImportCertStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA CryptQueryObject CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CertCreateCertificateChainEngine

ws2_32

closesocket recv send WSAGetLastError bind connect getpeername getsockname getsockopt ntohl gethostname sendto recvfrom freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen htonl htons WSACleanup WSAStartup WSAIoctl WSASetLastError socket setsockopt ntohs accept

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strchr strstr memcpy __std_exception_destroy __std_exception_copy _purecall memset __C_specific_handler _CxxThrowException __current_exception_context __current_exception memchr memcmp memmove strrchr __std_terminate

api-ms-win-crt-runtime-l1-1-0

strerror __sys_nerr _invalid_parameter_noinfo _set_app_type abort _invalid_parameter_noinfo_noreturn _register_thread_local_exe_atexit_callback _resetstkoflw _c_exit terminate _exit _initterm_e _initterm _get_narrow_winmain_command_line exit _getpid _beginthreadex _seh_filter_exe _cexit _errno _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-stdio-l1-1-0

ungetc setvbuf _lseeki64 fgetpos fwrite fgets _set_fmode fgetc __stdio_common_vsscanf __stdio_common_vsprintf __p__commode fread _wfopen _fseeki64 fclose _write _close _open fsetpos _get_stream_buffer_pointers __stdio_common_vsprintf_s feof fputs fputc __acrt_iob_func fopen fseek __stdio_common_vfprintf ftell _read __stdio_common_vswprintf fflush

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _stat64 _access _unlock_file remove _unlink _lock_file

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s _gmtime64 strftime

api-ms-win-crt-math-l1-1-0

__setusermatherr log2 sinf _dclass acosf ceil ceilf cosf fmodf sqrtf

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode realloc malloc _callnewh free

api-ms-win-crt-string-l1-1-0

strncpy strpbrk tolower strcmp strncmp _strdup isupper strspn strcspn

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

strtoll strtoul strtoull strtol strtod atoi

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_9203f727a886c21d2b4ec6f4d0ddd1ef_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawkeye_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_satacom_smoke-loader_stop_vidar

d3d9

d3dx9_43

kernel32

user32

gdi32

advapi32

shell32

msvcp140

normaliz

wldap32

crypt32

ws2_32

imm32

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic