2026-08-24_5cfaeea03e6caeaeaae76e02a7512eef_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_stop_vidar_wannacry

General

Target
2026-08-24_5cfaeea03e6caeaeaae76e02a7512eef_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_stop_vidar_wannacry
Size 16.5MB
Sample260825-pp46jascqf
SHA256 9000b8fa0d3e62793d488b92ca3e16dd3caf3b1c9b63954c71b6093089be2773
MD5 5cfaeea03e6caeaeaae76e02a7512eef
SHA1 c54a5002f36d653918a93b215e4185739ad8a099
SHA512 ad838c5e96dec6868c96ff029e23c799a010314ec5687ce4eae328c3eb27db5fa1db6ab624dffffe9a4d6ee7c2efcf13b33cbd92758c32927ef8dc638ac2b714
SSDEEP 196608:M3KWQc0gEYnvLhCK/I3KWQc0gEYnvLhCK/I3KWQc0gEYnvLhCK/+1y5nSQ6vOb:pcZEIvUicZEIvUicZEIvUly5n6a
TLSH
T11107C001B7D4D532F5B316318E7A92A15B7ABC615F31C68F33843A6D2E316D0AA39723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-24_5cfaeea03e6caeaeaae76e02a7512eef_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_stop_vidar_wannacry

File Explorer

2026-08-24_5cfaeea03e6caeaeaae76e02a7512eef_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_stop_vidar_wannacry

.exe 16.5MB

2026-08-24_5cfaeea03e6caeaeaae76e02a7512eef_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_stop_vidar_wannacry

IMPHASH 3c10d2aa2614755ccdb513472bf0a6a1
SHA256 9000b8fa0d3e62793d488b92ca3e16dd3caf3b1c9b63954c71b6093089be2773
MD5 5cfaeea03e6caeaeaae76e02a7512eef
SHA1 c54a5002f36d653918a93b215e4185739ad8a099
SHA512 ad838c5e96dec6868c96ff029e23c799a010314ec5687ce4eae328c3eb27db5fa1db6ab624dffffe9a4d6ee7c2efcf13b33cbd92758c32927ef8dc638ac2b714
SSDEEP 196608:M3KWQc0gEYnvLhCK/I3KWQc0gEYnvLhCK/I3KWQc0gEYnvLhCK/+1y5nSQ6vOb:pcZEIvUicZEIvUicZEIvUly5n6a
TLSH
T11107C001B7D4D532F5B316318E7A92A15B7ABC615F31C68F33843A6D2E316D0AA39723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
UPX dump on OEP (original entry point)
AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

15148

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileA FindClose FindFirstFileA FindNextFileA GetDriveTypeA GetFileSize GetLogicalDrives ReadFile WriteFile GetTempPathA GetTempFileNameA CloseHandle GetModuleFileNameA SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW

user32

MessageBoxA

shell32

ShellExecuteA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

memset __C_specific_handler __current_exception __current_exception_context _CxxThrowException memmove memcpy __std_exception_copy memcmp __std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

tolower strlen

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc

api-ms-win-crt-runtime-l1-1-0

_cexit _c_exit _register_thread_local_exe_atexit_callback _exit exit _initterm _get_initial_narrow_environment __p___argv _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initialize_narrow_environment _configure_narrow_argv __p___argc _seh_filter_exe _initterm_e _set_app_type

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-24_5cfaeea03e6caeaeaae76e02a7512eef_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_glassworm_hawkeye_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc_stop_vidar_wannacry

kernel32

user32

shell32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic