2026-08-12_bafc25d6180de24709143ba1c017785f_agent-tesla_elex_glassworm_icedid_loki-bot_njrat

General

Target
2026-08-12_bafc25d6180de24709143ba1c017785f_agent-tesla_elex_glassworm_icedid_loki-bot_njrat
Size 3.9MB
Sample260812-xkfw5sshmb
SHA256 efa88a3f88a422af89500169e32fb43e4159e64d8628b61f1d1173370a3c4f4e
MD5 bafc25d6180de24709143ba1c017785f
SHA1 416dcb8d6bdcc567a211617566ba102434dcff5d
SHA512 76eb0565d2aa3daeb42ddf8106a48f8f60d51be12e6ecf09a93962d3add87354d822667ec90f926c05616422ba26fba554545c51d39d4acc59784fd88be40c0e
SSDEEP 98304:Ed2is/cCqzCtD5q/Ni6ULf4DKyMK0LAIHgWTuO:Ed2vE/MU/N1ef4mjLjHgWT/
TLSH
T12216E03D99A41FD0F133B2340A61D151E1A5BD7A63108BCF27D9A6092B337F161BFA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_bafc25d6180de24709143ba1c017785f_agent-tesla_elex_glassworm_icedid_loki-bot_njrat

2026-08-12_bafc25d6180de24709143ba1c017785f_agent-tesla_elex_glassworm_icedid_loki-bot_njrat

.exe 3.9MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 efa88a3f88a422af89500169e32fb43e4159e64d8628b61f1d1173370a3c4f4e
MD5 bafc25d6180de24709143ba1c017785f
SHA1 416dcb8d6bdcc567a211617566ba102434dcff5d
SHA512 76eb0565d2aa3daeb42ddf8106a48f8f60d51be12e6ecf09a93962d3add87354d822667ec90f926c05616422ba26fba554545c51d39d4acc59784fd88be40c0e
SSDEEP 98304:Ed2is/cCqzCtD5q/Ni6ULf4DKyMK0LAIHgWTuO:Ed2vE/MU/N1ef4mjLjHgWT/
TLSH
T12216E03D99A41FD0F133B2340A61D151E1A5BD7A63108BCF27D9A6092B337F161BFA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths