2026-10-01_cc4faac6e0e7c4e27fce73bffb8f8906_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

General

Target
2026-10-01_cc4faac6e0e7c4e27fce73bffb8f8906_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar
Size 8.0MB
Sample261002-cwyacaxbpc
SHA256 c5b3a1ad37a09d43e83820452b9298276f3fedf607a3f5f12d935eb70ed5cc01
MD5 cc4faac6e0e7c4e27fce73bffb8f8906
SHA1 100147565ceec9db89b1054535640924123b3437
SHA512 bdaab4cd67d34b537291b5a449df07c8baf58b77ed08bc4c106f74c5a38dae5f0842623fb5423f41ec46db527258afeafe36c342bb80edbb314307ff3739e444
SSDEEP 196608:/PmJr/qn/L15fhoULbHAWKGbqwrL+K+Z6cGBRt:/uJbqn/L1FJf3pf+sn
TLSH
T16686F139E9A01FD4F433A6340661D551D1A97C3E63608BCF2798BA0A3B337E1647FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_cc4faac6e0e7c4e27fce73bffb8f8906_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

2026-10-01_cc4faac6e0e7c4e27fce73bffb8f8906_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_loki-bot_njrat_ramnit_vidar

.exe 8.0MB

IMPHASH 5d6cad172c5535e4b6b6bbd246571621
SHA256 c5b3a1ad37a09d43e83820452b9298276f3fedf607a3f5f12d935eb70ed5cc01
MD5 cc4faac6e0e7c4e27fce73bffb8f8906
SHA1 100147565ceec9db89b1054535640924123b3437
SHA512 bdaab4cd67d34b537291b5a449df07c8baf58b77ed08bc4c106f74c5a38dae5f0842623fb5423f41ec46db527258afeafe36c342bb80edbb314307ff3739e444
SSDEEP 196608:/PmJr/qn/L15fhoULbHAWKGbqwrL+K+Z6cGBRt:/uJbqn/L1FJf3pf+sn
TLSH
T16686F139E9A01FD4F433A6340661D551D1A97C3E63608BCF2798BA0A3B337E1647FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths