2026-09-23_d3cbca71f1b3ab56d288420a603903d1_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

General

Target
2026-09-23_d3cbca71f1b3ab56d288420a603903d1_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar
Size 8.0MB
Sample260924-bkkpfaag49
SHA256 3d8b5102d8a6b9c6c08a147a9459fc89348dab8f6098d90223cdcf822fd5431f
MD5 d3cbca71f1b3ab56d288420a603903d1
SHA1 3137c2f6082244c4b4b6b04ac65e39a468d24357
SHA512 8fced758499d323aa4f8fe25b995f41f2cdfda9366248f878f7d1206b8300d5cc0f2b766973e675a8ad6fc62c108ae384bfa1612efead17f1d13556bc1bafedb
SSDEEP 196608:Otgvi/Mj/e/5fmmQLmHs6KL6qwNLjKMZrbuB3+:O6v4Mj/e/Fsk7ECj3i
TLSH
T1F486F139E9A01FD4F433A6340661D551D1A97C3E63608BCF2798BA0A3B337E1647FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_d3cbca71f1b3ab56d288420a603903d1_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

2026-09-23_d3cbca71f1b3ab56d288420a603903d1_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

.exe 8.0MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 3d8b5102d8a6b9c6c08a147a9459fc89348dab8f6098d90223cdcf822fd5431f
MD5 d3cbca71f1b3ab56d288420a603903d1
SHA1 3137c2f6082244c4b4b6b04ac65e39a468d24357
SHA512 8fced758499d323aa4f8fe25b995f41f2cdfda9366248f878f7d1206b8300d5cc0f2b766973e675a8ad6fc62c108ae384bfa1612efead17f1d13556bc1bafedb
SSDEEP 196608:Otgvi/Mj/e/5fmmQLmHs6KL6qwNLjKMZrbuB3+:O6v4Mj/e/Fsk7ECj3i
TLSH
T1F486F139E9A01FD4F433A6340661D551D1A97C3E63608BCF2798BA0A3B337E1647FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths