2026-08-09_bf6c37e2f1b2862c02f50781276ba9ef_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

General

Target
2026-08-09_bf6c37e2f1b2862c02f50781276ba9ef_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar
Size 8.0MB
Sample260809-cglm1aybqa
SHA256 c9eb73df2ac4c47464f1aab22ba98193622c4ab9ff254ae10966d49e76696d5c
MD5 bf6c37e2f1b2862c02f50781276ba9ef
SHA1 dff4f5f4663af6adb22171f88157a74d0bc527b9
SHA512 803c13e6fbd67ce2d9195e0d43e8de148e5e07505e3ff10bc21fe1c4125fd5f790916718d9ef48368e490f3b2f343e3695d7f9fd69bed9e2436836aa65b9df9b
SSDEEP 196608:/P0viQqn/y15fhmwLbHgWKTsqw7qrK+ZcY/B8t:/8vnqn/y1FnfX83rKK
TLSH
T16F86F139E9A01FD4F433A6340661D551D1A97C3E63608BCF2798BA0A3B337E1647FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_bf6c37e2f1b2862c02f50781276ba9ef_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

2026-08-09_bf6c37e2f1b2862c02f50781276ba9ef_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

.exe 8.0MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 c9eb73df2ac4c47464f1aab22ba98193622c4ab9ff254ae10966d49e76696d5c
MD5 bf6c37e2f1b2862c02f50781276ba9ef
SHA1 dff4f5f4663af6adb22171f88157a74d0bc527b9
SHA512 803c13e6fbd67ce2d9195e0d43e8de148e5e07505e3ff10bc21fe1c4125fd5f790916718d9ef48368e490f3b2f343e3695d7f9fd69bed9e2436836aa65b9df9b
SSDEEP 196608:/P0viQqn/y15fhmwLbHgWKTsqw7qrK+ZcY/B8t:/8vnqn/y1FnfX83rKK
TLSH
T16F86F139E9A01FD4F433A6340661D551D1A97C3E63608BCF2798BA0A3B337E1647FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths