2026-07-22_d0864080240b867ce56d73cc217ab3f8_agent-tesla_elex_glassworm_icedid_loki-bot_njrat

General

Target
2026-07-22_d0864080240b867ce56d73cc217ab3f8_agent-tesla_elex_glassworm_icedid_loki-bot_njrat
Size 9.3MB
Sample260722-vhn4madl2s
SHA256 ce6ba2086597b2b63ecafb667c05ce1519078ca1aa5aa24470abacf11da92cb6
MD5 d0864080240b867ce56d73cc217ab3f8
SHA1 32065fb5c73d79c26748bd4bb643ac925cb2905c
SHA512 f97fb1efa96c70a779cbf7da6ec61c05b5f906ad2b5810e364fc124b13a010589a7a57844614b183904147dbc2a6bfc78e95f265addb238e3e952331e9913422
SSDEEP 196608:NjJ15KUxqnYKfcLibnLD9dppq/F0ri/mn/Ry5fmmpLDHgWvL:RJbKUxqnvdbntdYWr4mn/RyFtnXz
TLSH
T142A6F0368AA02F95F823513403E6C551DA2E7C3A632047CF775CFA4A2BB36D6147E61E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_d0864080240b867ce56d73cc217ab3f8_agent-tesla_elex_glassworm_icedid_loki-bot_njrat

2026-07-22_d0864080240b867ce56d73cc217ab3f8_agent-tesla_elex_glassworm_icedid_loki-bot_njrat

.exe 9.3MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 ce6ba2086597b2b63ecafb667c05ce1519078ca1aa5aa24470abacf11da92cb6
MD5 d0864080240b867ce56d73cc217ab3f8
SHA1 32065fb5c73d79c26748bd4bb643ac925cb2905c
SHA512 f97fb1efa96c70a779cbf7da6ec61c05b5f906ad2b5810e364fc124b13a010589a7a57844614b183904147dbc2a6bfc78e95f265addb238e3e952331e9913422
SSDEEP 196608:NjJ15KUxqnYKfcLibnLD9dppq/F0ri/mn/Ry5fmmpLDHgWvL:RJbKUxqnvdbntdYWr4mn/RyFtnXz
TLSH
T142A6F0368AA02F95F823513403E6C551DA2E7C3A632047CF775CFA4A2BB36D6147E61E
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths