2026-07-15_b8989f11ea792f102846355bbbb45491_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

General

Target
2026-07-15_b8989f11ea792f102846355bbbb45491_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar
Size 8.0MB
Sample260715-ez314set7s
SHA256 2159be8d7866fcccc499e24bb6fb56bdd7480f2ed34d7e9cf9be9e87fa0f62e5
MD5 b8989f11ea792f102846355bbbb45491
SHA1 9801cc6d3f63dd3fa5d77dc014d332375442dda5
SHA512 2d41bc3ac4601d98a13063dc77ae0d656afd82ca21913834156db00555136d44e86019dcb3f1d156f9f0998085786d6e8285632d34f74acd1ac289fa6467a646
SSDEEP 196608:E901i/qn/B15fmmpLDHgYKL6qwWL+K+ZrzNB3t:EO14qn/B1Ft3REp+hJ
TLSH
T1A786F139E9A01FD4F433A6340661D551D1A97C3E63608BCF2798BA0A3B337E1647FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_b8989f11ea792f102846355bbbb45491_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

2026-07-15_b8989f11ea792f102846355bbbb45491_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

.exe 8.0MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 2159be8d7866fcccc499e24bb6fb56bdd7480f2ed34d7e9cf9be9e87fa0f62e5
MD5 b8989f11ea792f102846355bbbb45491
SHA1 9801cc6d3f63dd3fa5d77dc014d332375442dda5
SHA512 2d41bc3ac4601d98a13063dc77ae0d656afd82ca21913834156db00555136d44e86019dcb3f1d156f9f0998085786d6e8285632d34f74acd1ac289fa6467a646
SSDEEP 196608:E901i/qn/B15fmmpLDHgYKL6qwWL+K+ZrzNB3t:EO14qn/B1Ft3REp+hJ
TLSH
T1A786F139E9A01FD4F433A6340661D551D1A97C3E63608BCF2798BA0A3B337E1647FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths