2026-07-31_03b76658184372ce98a5de69d7b00f0c_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

General

Target
2026-07-31_03b76658184372ce98a5de69d7b00f0c_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar
Size 10.5MB
Sample260731-prb8jaaf75
SHA256 78bd8009ece4bc38004d17df7016e225d392383bbb2b3dd0bf5485ecc6d58f55
MD5 03b76658184372ce98a5de69d7b00f0c
SHA1 83a8d13cfb499b8e3aa1c355cd2c3b2a8ae5b463
SHA512 f7ae5ff333d7a2205274852185099509ed6a45487b8507fcd2a3b6dbd5be69b31e2de79ec8986da9aff56f53d5b5febc0b9ec628db9fd689692da40daf52740f
SSDEEP 196608:7TJ1GKUxq8Y8fc4pbnLr9YppqMP0vicMn/R15OmmpLZHgKKL6/w7LTK+:vJEKUxq8tjbnFY78vDMn/R1At1TEBT
TLSH
T10AB6F1369AA01F95F833913403A6C552DA6E7C3A632047CF779CF64A2BB32D1147E61E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_03b76658184372ce98a5de69d7b00f0c_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

2026-07-31_03b76658184372ce98a5de69d7b00f0c_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

.exe 10.5MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 78bd8009ece4bc38004d17df7016e225d392383bbb2b3dd0bf5485ecc6d58f55
MD5 03b76658184372ce98a5de69d7b00f0c
SHA1 83a8d13cfb499b8e3aa1c355cd2c3b2a8ae5b463
SHA512 f7ae5ff333d7a2205274852185099509ed6a45487b8507fcd2a3b6dbd5be69b31e2de79ec8986da9aff56f53d5b5febc0b9ec628db9fd689692da40daf52740f
SSDEEP 196608:7TJ1GKUxq8Y8fc4pbnLr9YppqMP0vicMn/R15OmmpLZHgKKL6/w7LTK+:vJEKUxq8tjbnFY78vDMn/R1At1TEBT
TLSH
T10AB6F1369AA01F95F833913403A6C552DA6E7C3A632047CF779CF64A2BB32D1147E61E
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths