2026-08-04_0b76322305bd8ade2dfc247dbe8990d4_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

General

Target
2026-08-04_0b76322305bd8ade2dfc247dbe8990d4_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar
Size 4.9MB
Sample260804-kctrtavgka
SHA256 5a9ae8931df1db9fc201d078f038869d859468aa3db55748aa0058bd30c66e0b
MD5 0b76322305bd8ade2dfc247dbe8990d4
SHA1 3200e3d134ea849952b761ee2f8a61f8a96fdbe3
SHA512 02e7d51d6135f8fcda9bde03ee6d64bf6a0fe32775dd00c7e3608f87d2e2854d51ef6155a627749521e4f6a8f16b7beeafc3b1c92cf0dd25066f349bf8798bc4
SSDEEP 98304:E+4isucCqzD8DWx/Ri6pLfmD9yMc0XnqHAWKua/ZQmJqw:E+4v5/m4/R15fmZpXqHAWKH5qw
TLSH
T1C736E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_0b76322305bd8ade2dfc247dbe8990d4_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

2026-08-04_0b76322305bd8ade2dfc247dbe8990d4_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar

.exe 4.9MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 5a9ae8931df1db9fc201d078f038869d859468aa3db55748aa0058bd30c66e0b
MD5 0b76322305bd8ade2dfc247dbe8990d4
SHA1 3200e3d134ea849952b761ee2f8a61f8a96fdbe3
SHA512 02e7d51d6135f8fcda9bde03ee6d64bf6a0fe32775dd00c7e3608f87d2e2854d51ef6155a627749521e4f6a8f16b7beeafc3b1c92cf0dd25066f349bf8798bc4
SSDEEP 98304:E+4isucCqzD8DWx/Ri6pLfmD9yMc0XnqHAWKua/ZQmJqw:E+4v5/m4/R15fmZpXqHAWKH5qw
TLSH
T1C736E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths