2026-07-02_1710a06d5acceab1aff8d5153765b47c_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

General

Target
2026-07-02_1710a06d5acceab1aff8d5153765b47c_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar
Size 5.6MB
Sample260702-2zfbdagt2s
SHA256 dca74ee6744440b82ad4e5ec322bda582581a035701ba8279937f76eddee6cfa
MD5 1710a06d5acceab1aff8d5153765b47c
SHA1 cc5f0961b9596e14ef42cf28850c2e75adcad0ac
SHA512 4e43bdadca6cbe7a1659f057f7de2a509728f95604b95677f98f83028cfb36249535f3a755a07e030b5b02bdecd8a9f18d95ef7edf656d29b64eb7caad8118ed
SSDEEP 98304:EP0isBcCqzCtDWq/ii6pLfmDVyMc0L2qHgWKuu/nimxqwZmo/LRhK:EP0vi/Mn/i15fmJpLDHgWKLZqw5LTK
TLSH
T18756F139E9A41ED4F033F2344661D411E2A57C7A63108BCF27D9A60A2B337F1657FA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_1710a06d5acceab1aff8d5153765b47c_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

2026-07-02_1710a06d5acceab1aff8d5153765b47c_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

.exe 5.6MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 dca74ee6744440b82ad4e5ec322bda582581a035701ba8279937f76eddee6cfa
MD5 1710a06d5acceab1aff8d5153765b47c
SHA1 cc5f0961b9596e14ef42cf28850c2e75adcad0ac
SHA512 4e43bdadca6cbe7a1659f057f7de2a509728f95604b95677f98f83028cfb36249535f3a755a07e030b5b02bdecd8a9f18d95ef7edf656d29b64eb7caad8118ed
SSDEEP 98304:EP0isBcCqzCtDWq/ii6pLfmDVyMc0L2qHgWKuu/nimxqwZmo/LRhK:EP0vi/Mn/i15fmJpLDHgWKLZqw5LTK
TLSH
T18756F139E9A41ED4F033F2344661D411E2A57C7A63108BCF27D9A60A2B337F1657FA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths