2026-07-19_020f075459228de990cb72e527f94268_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

General

Target
2026-07-19_020f075459228de990cb72e527f94268_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar
Size 4.9MB
Sample260719-vwer4sat2v
SHA256 7d2dbf9619d2e4ad87b255f22efb3536bb259ddc885c23edc386c49ece411a4c
MD5 020f075459228de990cb72e527f94268
SHA1 415fab5d00b59a66f0568b83c63e989ec35056cf
SHA512 39d9088bde837acef35f0333d11d696d3746146f4f2a6977b1dda7bd9abc77c6076eec223127c5039c8d781d91c663fada6a785d20fa56cf4bd349eb0d49e72c
SSDEEP 98304:E92asBcCqzztDWq99i6pLfLDKyMK0LyqHgWKuu/nimsFw:E92Xi/Jn9915fLmjLHHgWKL0Fw
TLSH
T16036E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-19_020f075459228de990cb72e527f94268_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

2026-07-19_020f075459228de990cb72e527f94268_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

.exe 4.9MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 7d2dbf9619d2e4ad87b255f22efb3536bb259ddc885c23edc386c49ece411a4c
MD5 020f075459228de990cb72e527f94268
SHA1 415fab5d00b59a66f0568b83c63e989ec35056cf
SHA512 39d9088bde837acef35f0333d11d696d3746146f4f2a6977b1dda7bd9abc77c6076eec223127c5039c8d781d91c663fada6a785d20fa56cf4bd349eb0d49e72c
SSDEEP 98304:E92asBcCqzztDWq99i6pLfLDKyMK0LyqHgWKuu/nimsFw:E92Xi/Jn9915fLmjLHHgWKL0Fw
TLSH
T16036E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths