2026-07-09_6e62cc9bff4e1f16da9c77d46b51043c_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

General

Target
2026-07-09_6e62cc9bff4e1f16da9c77d46b51043c_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar
Size 8.0MB
Sample260709-kdh2pse18p
SHA256 73e92e83bdc342f32c728906986d3fbcf42f0292a4c653b9f84fc0a1977d3949
MD5 6e62cc9bff4e1f16da9c77d46b51043c
SHA1 9047bcbb7e6ecee43cc596221bc107afef9abaf7
SHA512 2c7f15b8c4ac646960a9e4cc593a5cf772d461766b4f5c5be4973768659c07176771f25030ca3eaf0c9b13cc4dcc38aab7539d09e02c2c9a52b18666abe19711
SSDEEP 196608:/P0viWqn/R13fhmpLeHgWKTHqw7L+K+ZcY/B3t:/8vFqn/R1v+EX87+KK
TLSH
T10986F139E9A01FD4F433A6340661D551D1A97C3E63608BCF2798BA0A3B337E1647FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_6e62cc9bff4e1f16da9c77d46b51043c_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

2026-07-09_6e62cc9bff4e1f16da9c77d46b51043c_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

.exe 8.0MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 73e92e83bdc342f32c728906986d3fbcf42f0292a4c653b9f84fc0a1977d3949
MD5 6e62cc9bff4e1f16da9c77d46b51043c
SHA1 9047bcbb7e6ecee43cc596221bc107afef9abaf7
SHA512 2c7f15b8c4ac646960a9e4cc593a5cf772d461766b4f5c5be4973768659c07176771f25030ca3eaf0c9b13cc4dcc38aab7539d09e02c2c9a52b18666abe19711
SSDEEP 196608:/P0viWqn/R13fhmpLeHgWKTHqw7L+K+ZcY/B3t:/8vFqn/R1v+EX87+KK
TLSH
T10986F139E9A01FD4F433A6340661D551D1A97C3E63608BCF2798BA0A3B337E1647FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths