General
- Target 2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_zxxz
- Size 43.4MB
- Sample260423-ffkwvsa191
- SHA256 16486dce457024bb3150bb232e5a766773be563448b9bcd2b6bc3b0e96b9adf0
Score
10/10
Malware Config
Targets
-
- Target 2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_zxxz
- Size 43.4MB
- SHA256 16486dce457024bb3150bb232e5a766773be563448b9bcd2b6bc3b0e96b9adf0
Score9/10-
Enumerates VirtualBox registry keys
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Enumerates processes with tasklist
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Virtualization/Sandbox Evasion
4