2026-07-27_75ae7380de996aaf794379db2820d333_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

General

Target
2026-07-27_75ae7380de996aaf794379db2820d333_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar
Size 8.0MB
Sample260727-hek7caxtcs
SHA256 aaa3914c4be2fca48a37222b7eafaa957ef5d0188677acb9aaa5bd448a2c9970
MD5 75ae7380de996aaf794379db2820d333
SHA1 3d604d555e27b96bc9f1fcfe8aecb33d9e781e2a
SHA512 3fd2f7829d0f3803935f27c6d5c6e74e4d57d1fbf86e20cf9fa35469900e0dc5711604de6b55dadf411ecac278e53f936472ef1555e83b4d45edcc1a0233052b
SSDEEP 196608:/U6viXqn/y1mfBmUL+HgWKTOqDjL+K+ZXY/BEd:/Hvoqn/y1sXMX81+1K
TLSH
T13E86F139E9A01FD4F433A6340661D551D1A97C3E63608BCF2798BA0A2B337E1647FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_75ae7380de996aaf794379db2820d333_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

2026-07-27_75ae7380de996aaf794379db2820d333_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

.exe 8.0MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 aaa3914c4be2fca48a37222b7eafaa957ef5d0188677acb9aaa5bd448a2c9970
MD5 75ae7380de996aaf794379db2820d333
SHA1 3d604d555e27b96bc9f1fcfe8aecb33d9e781e2a
SHA512 3fd2f7829d0f3803935f27c6d5c6e74e4d57d1fbf86e20cf9fa35469900e0dc5711604de6b55dadf411ecac278e53f936472ef1555e83b4d45edcc1a0233052b
SSDEEP 196608:/U6viXqn/y1mfBmUL+HgWKTOqDjL+K+ZXY/BEd:/Hvoqn/y1sXMX81+1K
TLSH
T13E86F139E9A01FD4F433A6340661D551D1A97C3E63608BCF2798BA0A2B337E1647FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths