2026-07-30_1092222b646738c479e3a7c2a4ebabaf_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

General

Target
2026-07-30_1092222b646738c479e3a7c2a4ebabaf_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar
Size 5.7MB
Sample260730-nt78bagg48
SHA256 ad263f344bd2a1d8c7f00ab5836f78de83a86e2b4abdc3966e79f65ca863609e
MD5 1092222b646738c479e3a7c2a4ebabaf
SHA1 a9f561f77cf36cbcf815de3fb61cf66888a2f370
SHA512 e661713f3afefd029490c03ca26ffd6368fbb2075ed38545fa39e4397efdaae46087e8fe8cb3a13fde51e3b24b75b7b54483c7521f10acc67d0c08e92fe40680
SSDEEP 98304:EPsisBcXqzCtDWq/Ri6pLOmDKyMc0L2qHgWKuu/nimSqwZmogLRhK+D:EPsvicMn/R15OmmpLDHgWKL6qwSLTK+D
TLSH
T1B356F139E9A41ED4F033F2344661D411E2A57C7A63108BCF27D9A60A2B337F1657FA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_1092222b646738c479e3a7c2a4ebabaf_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

2026-07-30_1092222b646738c479e3a7c2a4ebabaf_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

.exe 5.7MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 ad263f344bd2a1d8c7f00ab5836f78de83a86e2b4abdc3966e79f65ca863609e
MD5 1092222b646738c479e3a7c2a4ebabaf
SHA1 a9f561f77cf36cbcf815de3fb61cf66888a2f370
SHA512 e661713f3afefd029490c03ca26ffd6368fbb2075ed38545fa39e4397efdaae46087e8fe8cb3a13fde51e3b24b75b7b54483c7521f10acc67d0c08e92fe40680
SSDEEP 98304:EPsisBcXqzCtDWq/Ri6pLOmDKyMc0L2qHgWKuu/nimSqwZmogLRhK+D:EPsvicMn/R15OmmpLDHgWKL6qwSLTK+D
TLSH
T1B356F139E9A41ED4F033F2344661D411E2A57C7A63108BCF27D9A60A2B337F1657FA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths