2026-08-17_9662211cb0975afa9cd8e758172fa56a_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

General

Target
2026-08-17_9662211cb0975afa9cd8e758172fa56a_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar
Size 8.0MB
Sample260817-p5dnhsbp9x
SHA256 1d64595c994f1455ec562e352dc63b7bf6312ae2353d18113f6599a09102d277
MD5 9662211cb0975afa9cd8e758172fa56a
SHA1 7999093520c9f47a27be661933d847e92126b5fa
SHA512 e2536fa260d0785d76a71b42a4bc9f0979758a86d497fcedee2cfa4f91c22be5e181b840df57611d41019db49515546e7106a0c4ff2346c74635ccbd0b71671c
SSDEEP 196608:EP/ui/u8/+15fmmpLnHgWSL6rwVLYK+bJXqBRt:E3u4u8/+1FtjXMjY1a
TLSH
T12E86F139E9A01FD4F433A6340661D551D1A97C3E63608BCF2798BA0A3B337E1647FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-17_9662211cb0975afa9cd8e758172fa56a_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

2026-08-17_9662211cb0975afa9cd8e758172fa56a_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

.exe 8.0MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 1d64595c994f1455ec562e352dc63b7bf6312ae2353d18113f6599a09102d277
MD5 9662211cb0975afa9cd8e758172fa56a
SHA1 7999093520c9f47a27be661933d847e92126b5fa
SHA512 e2536fa260d0785d76a71b42a4bc9f0979758a86d497fcedee2cfa4f91c22be5e181b840df57611d41019db49515546e7106a0c4ff2346c74635ccbd0b71671c
SSDEEP 196608:EP/ui/u8/+15fmmpLnHgWSL6rwVLYK+bJXqBRt:E3u4u8/+1FtjXMjY1a
TLSH
T12E86F139E9A01FD4F433A6340661D551D1A97C3E63608BCF2798BA0A3B337E1647FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths