2026-08-09_e5c1717e215d8c926c9208b39d57668b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry

General

Target
2026-08-09_e5c1717e215d8c926c9208b39d57668b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry
Size 12.9MB
Sample260809-fe2g8atybt
SHA256 6d2cb58b655ed5f24d3c0eabd7e376ab132a555833d245b33c5b5ecc77a260f0
MD5 e5c1717e215d8c926c9208b39d57668b
SHA1 a8be9a07dfe17a5316350a437f16c5b02cfee886
SHA512 d50b51cc7b8491be3ba32454e9cab286d4afa14ca5aa4e0d34e5a13abf55df8a9e59e7420370f2039c9a4be413d3eff6e930cf94635084833d9e6081a8960765
SSDEEP 196608:E36vi/Mn/R15fFmaLDHgmKLTqBXLtK+ZrIcBEtYdgM5ZjBxcO4bjV2VNWqP51mIH:Eqv4Mn/R1F5nHEothVVhJM2NH5sI
TLSH
T123D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_e5c1717e215d8c926c9208b39d57668b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry

2026-08-09_e5c1717e215d8c926c9208b39d57668b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_luca-stealer_njrat_ramnit_smoke-loader_stealc_vidar_wannacry

.exe 12.9MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 6d2cb58b655ed5f24d3c0eabd7e376ab132a555833d245b33c5b5ecc77a260f0
MD5 e5c1717e215d8c926c9208b39d57668b
SHA1 a8be9a07dfe17a5316350a437f16c5b02cfee886
SHA512 d50b51cc7b8491be3ba32454e9cab286d4afa14ca5aa4e0d34e5a13abf55df8a9e59e7420370f2039c9a4be413d3eff6e930cf94635084833d9e6081a8960765
SSDEEP 196608:E36vi/Mn/R15fFmaLDHgmKLTqBXLtK+ZrIcBEtYdgM5ZjBxcO4bjV2VNWqP51mIH:Eqv4Mn/R1F5nHEothVVhJM2NH5sI
TLSH
T123D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths