2026-07-30_5032de80bbbb2224d87532d5c7ed99e2_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

General

Target
2026-07-30_5032de80bbbb2224d87532d5c7ed99e2_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar
Size 4.9MB
Sample260730-d2216ack7s
SHA256 1fc95a00b980d524ee7f9786a06dcf45cbf496f68a79ada45102623ad7864020
MD5 5032de80bbbb2224d87532d5c7ed99e2
SHA1 3960d88d39f03b0d2d930785a26b4c887620ac22
SHA512 3f9a679d9498745a67b6b4eec37319cf4de7b9e92ab52edfc5fc49fbb4525def1ff454b6314d3e7c80374fd3654bdb19615110c07ac0ac555573d5da01788c79
SSDEEP 98304:EL0isBcCqztHDWq/Ri6/6fjDKyMt0L+sHg2Iuu/wipSAw:EL0vi/Nn/R1yfjmYLtHg2ILeAw
TLSH
T1E236E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_5032de80bbbb2224d87532d5c7ed99e2_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

2026-07-30_5032de80bbbb2224d87532d5c7ed99e2_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

.exe 4.9MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 1fc95a00b980d524ee7f9786a06dcf45cbf496f68a79ada45102623ad7864020
MD5 5032de80bbbb2224d87532d5c7ed99e2
SHA1 3960d88d39f03b0d2d930785a26b4c887620ac22
SHA512 3f9a679d9498745a67b6b4eec37319cf4de7b9e92ab52edfc5fc49fbb4525def1ff454b6314d3e7c80374fd3654bdb19615110c07ac0ac555573d5da01788c79
SSDEEP 98304:EL0isBcCqztHDWq/Ri6/6fjDKyMt0L+sHg2Iuu/wipSAw:EL0vi/Nn/R1yfjmYLtHg2ILeAw
TLSH
T1E236E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths