2026-07-30_dd68deb3f2c289783a13217463ced9df_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

General

Target
2026-07-30_dd68deb3f2c289783a13217463ced9df_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar
Size 5.7MB
Sample260730-m74llswdma
SHA256 761549e4d4785ac7d6f4eea45b97ffc7a3c338a68f5894f474c056021f5c5129
MD5 dd68deb3f2c289783a13217463ced9df
SHA1 aa0652a3d02707ad24cdf8b02f8040274d610b83
SHA512 cc7a9993db16310f9c4b78d18c64bd473e4f56cad44da3840ce92f815a173d477440ab7df3eec9e151ab6180f675fc45762c03bf5f19470ed4a0e25d431374b1
SSDEEP 98304:EP0isBcXqzCtDtq/Ri6pLOmDKyMc0LvqHgKKuu/nimUqwUmogLRhK+:EP0vicM4/R15OmmpLyHgKKLcqwfLTK+
TLSH
T1F656F139E9A41ED4F033F2344661D411E2A57C7A63108BCF27D9A60A2B337F1657FA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_dd68deb3f2c289783a13217463ced9df_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

2026-07-30_dd68deb3f2c289783a13217463ced9df_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

.exe 5.7MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 761549e4d4785ac7d6f4eea45b97ffc7a3c338a68f5894f474c056021f5c5129
MD5 dd68deb3f2c289783a13217463ced9df
SHA1 aa0652a3d02707ad24cdf8b02f8040274d610b83
SHA512 cc7a9993db16310f9c4b78d18c64bd473e4f56cad44da3840ce92f815a173d477440ab7df3eec9e151ab6180f675fc45762c03bf5f19470ed4a0e25d431374b1
SSDEEP 98304:EP0isBcXqzCtDtq/Ri6pLOmDKyMc0LvqHgKKuu/nimUqwUmogLRhK+:EP0vicM4/R15OmmpLyHgKKLcqwfLTK+
TLSH
T1F656F139E9A41ED4F033F2344661D411E2A57C7A63108BCF27D9A60A2B337F1657FA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths