2026-07-29_2cb9083d6643da80f8be3dd944edfdae_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

General

Target
2026-07-29_2cb9083d6643da80f8be3dd944edfdae_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar
Size 8.0MB
Sample260729-2vda8agc77
SHA256 4ac4ca1508d8e8038180a3d5317982a2cda8aee663f2c0f7dd8716a08d2425e4
MD5 2cb9083d6643da80f8be3dd944edfdae
SHA1 471c4d48389dc352d7e649ca478b2a196ff49699
SHA512 96681945c73d95872011a98119c733f0c0c7cf825d20d875cb5d4ca20e7505da01e366e28360436831e96a4ccd400f05b3ca7f3c6ecf0f94ef9aff094e16a806
SSDEEP 196608:EM0oi/qn/U15fmmpL0HgWKLDqwULOw+MgJ/B3e:EFo4qn/U1FtyXEIOhd
TLSH
T1C686F139E9A01FD4F433A6340661D551D1A97C3E63608BCF2798FA0A2B337E1647FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_2cb9083d6643da80f8be3dd944edfdae_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

2026-07-29_2cb9083d6643da80f8be3dd944edfdae_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

.exe 8.0MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 4ac4ca1508d8e8038180a3d5317982a2cda8aee663f2c0f7dd8716a08d2425e4
MD5 2cb9083d6643da80f8be3dd944edfdae
SHA1 471c4d48389dc352d7e649ca478b2a196ff49699
SHA512 96681945c73d95872011a98119c733f0c0c7cf825d20d875cb5d4ca20e7505da01e366e28360436831e96a4ccd400f05b3ca7f3c6ecf0f94ef9aff094e16a806
SSDEEP 196608:EM0oi/qn/U15fmmpL0HgWKLDqwULOw+MgJ/B3e:EFo4qn/U1FtyXEIOhd
TLSH
T1C686F139E9A01FD4F433A6340661D551D1A97C3E63608BCF2798FA0A2B337E1647FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths