General
- Target 2026-11-02_ce2af4412f0de69cb428c6fcc19ebf6d_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos
- Size 4.4MB
- Sample261102-193c8afx6l
- SHA256 395ffc8fb33d7ac31a8193785c2850c9fa3cd482620c2c61e01df9f7d4af1e2d
- MD5 ce2af4412f0de69cb428c6fcc19ebf6d
- SHA1 e19370b7d5b1e9ab7148aa175cd6943009288a9a
- SHA512 060531375de6cbc480af00b84a88ed48b18e0a3f66d5d64fbb2edf7cc40034f91d0b0cc325038ec0a7000a6560fd6d7c5fd13ad9af9832ec367036509983e7ba
- SSDEEP 98304:B2cPK8DG0lnrGZlcjp/Nrbkm2u4Ms61ixdfdXOR:YCKUragp/5T2wXcvFOR
- TLSH T1932602036380D032EE6A81735F26B3929D797C7E4637C91F22D83EAA6874771223D567
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-11-02_ce2af4412f0de69cb428c6fcc19ebf6d_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos.exe
Resource
win10v2004-20260911-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-02_ce2af4412f0de69cb428c6fcc19ebf6d_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos.exe
Resource
win11ltsc2024-20260911-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-02_ce2af4412f0de69cb428c6fcc19ebf6d_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos
- Size 4.4MB
- SHA256 395ffc8fb33d7ac31a8193785c2850c9fa3cd482620c2c61e01df9f7d4af1e2d
- MD5 ce2af4412f0de69cb428c6fcc19ebf6d
- SHA1 e19370b7d5b1e9ab7148aa175cd6943009288a9a
- SHA512 060531375de6cbc480af00b84a88ed48b18e0a3f66d5d64fbb2edf7cc40034f91d0b0cc325038ec0a7000a6560fd6d7c5fd13ad9af9832ec367036509983e7ba
- SSDEEP 98304:B2cPK8DG0lnrGZlcjp/Nrbkm2u4Ms61ixdfdXOR:YCKUragp/5T2wXcvFOR
- TLSH T1932602036380D032EE6A81735F26B3929D797C7E4637C91F22D83EAA6874771223D567
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Executes dropped EXE
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
AutoIT Executable
AutoIT scripts compiled to PE executables.