2026-07-29_40ece6e1f43113be2b6946779959bf86_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

General

Target
2026-07-29_40ece6e1f43113be2b6946779959bf86_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar
Size 9.8MB
Sample260729-2rckhsxtew
SHA256 ce7612f4301dd8e87c6bb4d19df1882f8dcdd6a445158a48f24d629fe123579c
MD5 40ece6e1f43113be2b6946779959bf86
SHA1 ac9825d403da5405621dd2fb16d19662903f0d61
SHA512 f3539f6aff3bd45db148b7c4e059341987c7f94c972fd88a7f93b4b27fc0d6fe63e68f5e4042883f174786902529e4bf05989ee686d7ba6f1e9120301293cb8f
SSDEEP 196608:NqJ1GKUxqnYffclibnLD/d6pqMPevz/Mv/R15fmVpLDHgWKLnqw:cJEKUxqna/bnvdQmvzMv/R1F2nXE
TLSH
T1B9A6F0369AA01F95F833913403A6C552DA2E7C3A632047CF779CF65A2BB32D1147E61E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_40ece6e1f43113be2b6946779959bf86_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

2026-07-29_40ece6e1f43113be2b6946779959bf86_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

.exe 9.8MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 ce7612f4301dd8e87c6bb4d19df1882f8dcdd6a445158a48f24d629fe123579c
MD5 40ece6e1f43113be2b6946779959bf86
SHA1 ac9825d403da5405621dd2fb16d19662903f0d61
SHA512 f3539f6aff3bd45db148b7c4e059341987c7f94c972fd88a7f93b4b27fc0d6fe63e68f5e4042883f174786902529e4bf05989ee686d7ba6f1e9120301293cb8f
SSDEEP 196608:NqJ1GKUxqnYffclibnLD/d6pqMPevz/Mv/R15fmVpLDHgWKLnqw:cJEKUxqna/bnvdQmvzMv/R1F2nXE
TLSH
T1B9A6F0369AA01F95F833913403A6C552DA2E7C3A632047CF779CF65A2BB32D1147E61E
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths