2026-07-08_b2b5f17c96e2b0ebf39e2d4b9b55ba6f_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

General

Target
2026-07-08_b2b5f17c96e2b0ebf39e2d4b9b55ba6f_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar
Size 4.9MB
Sample260708-gtesfacw4p
SHA256 7bf6ac8d0336af783e4964d1995c0608a395747eeca82843a3ff6751af4d2e7a
MD5 b2b5f17c96e2b0ebf39e2d4b9b55ba6f
SHA1 83450a6ea572f17fe67e0e3c1b293f2a3296e88a
SHA512 a77034ed2ecde7690afd816169f4349cc053193bb4f1b4d5eb3f1f0c78e5df3fa21341a53be55784a93fbb77768c464747793cfb6f917b2b40db462354ba1085
SSDEEP 98304:EJ0isBcCqzCtDWq/Ri6fLfmDKyMc0L1qHgWKuu/nimSqw:EJ0vi/Mn/R1DfmmpL8HgWKL6qw
TLSH
T15C36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_b2b5f17c96e2b0ebf39e2d4b9b55ba6f_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

2026-07-08_b2b5f17c96e2b0ebf39e2d4b9b55ba6f_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

.exe 4.9MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 7bf6ac8d0336af783e4964d1995c0608a395747eeca82843a3ff6751af4d2e7a
MD5 b2b5f17c96e2b0ebf39e2d4b9b55ba6f
SHA1 83450a6ea572f17fe67e0e3c1b293f2a3296e88a
SHA512 a77034ed2ecde7690afd816169f4349cc053193bb4f1b4d5eb3f1f0c78e5df3fa21341a53be55784a93fbb77768c464747793cfb6f917b2b40db462354ba1085
SSDEEP 98304:EJ0isBcCqzCtDWq/Ri6fLfmDKyMc0L1qHgWKuu/nimSqw:EJ0vi/Mn/R1DfmmpL8HgWKL6qw
TLSH
T15C36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths