2026-07-09_b4905c70a786f241243f6cafd1f4dba7_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

General

Target
2026-07-09_b4905c70a786f241243f6cafd1f4dba7_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar
Size 4.9MB
Sample260710-adbbracs2z
SHA256 9165bf51e3483ac0e1be967d5fd2acb87306f96b3468699e45e2878c37cbd1f6
MD5 b4905c70a786f241243f6cafd1f4dba7
SHA1 d7ec95a7d00909931ca58fb848fd64fdf0775817
SHA512 a46ba805da123c79d21766287d3fa8274f40a98e877721882daced74539d26ae396f6010e150056d4c61273622e4428d4aa8f21ce82c172ae891988c9b8e6a28
SSDEEP 98304:EPR+sBcCqzCtDWq/Ri69Lf/DKyMF0VIqHgOKuu/Pimvqw:EPRTi/Mn/R1Vf/m0VhHgOKL/qw
TLSH
T12236E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_b4905c70a786f241243f6cafd1f4dba7_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

2026-07-09_b4905c70a786f241243f6cafd1f4dba7_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

.exe 4.9MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 9165bf51e3483ac0e1be967d5fd2acb87306f96b3468699e45e2878c37cbd1f6
MD5 b4905c70a786f241243f6cafd1f4dba7
SHA1 d7ec95a7d00909931ca58fb848fd64fdf0775817
SHA512 a46ba805da123c79d21766287d3fa8274f40a98e877721882daced74539d26ae396f6010e150056d4c61273622e4428d4aa8f21ce82c172ae891988c9b8e6a28
SSDEEP 98304:EPR+sBcCqzCtDWq/Ri69Lf/DKyMF0VIqHgOKuu/Pimvqw:EPRTi/Mn/R1Vf/m0VhHgOKL/qw
TLSH
T12236E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths