2026-07-11_4a79b13bdcf898072f159cf41b3a9aa1_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

General

Target
2026-07-11_4a79b13bdcf898072f159cf41b3a9aa1_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar
Size 7.7MB
Sample260711-gr5wvaey9v
SHA256 528a6ffd86d5d8f024a3270136acd2e95fc55067cf7f02b7f89f61a44f4a7636
MD5 4a79b13bdcf898072f159cf41b3a9aa1
SHA1 f87299ca301f6536b2f8665451b643e3810b1d6c
SHA512 505da60471dd1c8cb0a85ac2623e8452e04db560279fc6cbc606c4f7cf6225b7f4541590647241b462a731f93f5246d61711758f50721b1f56f64d053b08ec8c
SSDEEP 196608:72bnLDHdOpqMP0vi/vn/R15fmYpLDHgWKL6qw:CbnXdM8v4vn/R1FznXE
TLSH
T14486F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_4a79b13bdcf898072f159cf41b3a9aa1_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

2026-07-11_4a79b13bdcf898072f159cf41b3a9aa1_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

.exe 7.7MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 528a6ffd86d5d8f024a3270136acd2e95fc55067cf7f02b7f89f61a44f4a7636
MD5 4a79b13bdcf898072f159cf41b3a9aa1
SHA1 f87299ca301f6536b2f8665451b643e3810b1d6c
SHA512 505da60471dd1c8cb0a85ac2623e8452e04db560279fc6cbc606c4f7cf6225b7f4541590647241b462a731f93f5246d61711758f50721b1f56f64d053b08ec8c
SSDEEP 196608:72bnLDHdOpqMP0vi/vn/R15fmYpLDHgWKL6qw:CbnXdM8v4vn/R1FznXE
TLSH
T14486F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths