9981e757610a6c33fa1f310ca625ee3edcd40b956b6890bb1d6aa12aa911b94a

General

Target
2026-06-28_814f5d6d5a5d19668d38dab6115ff485_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_zxxz
Size 106.8MB
Sample260628-z4evase12j
SHA256 9981e757610a6c33fa1f310ca625ee3edcd40b956b6890bb1d6aa12aa911b94a
MD5 814f5d6d5a5d19668d38dab6115ff485
SHA1 bae1139d033a74983a769742695bb78ddff3a48f
SHA512 4b374daa1700e9fbb3592540625386dfc23d0f49cb29f326aa31df32aabd251606f1b9469129f1ebe9483beff167c07fc81ff074978e1595a05e37d59808783e
SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYf/:sMguj8Q4VfvJqFTrYK/WytVoVHvUf
TLSH
T171388D3233F60532D56352764A8B4002EF31B0577B24CAD7758C63682F4BFB4AAB6B95
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-28_814f5d6d5a5d19668d38dab6115ff485_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_zxxz
- Size 106.8MB
- SHA256 9981e757610a6c33fa1f310ca625ee3edcd40b956b6890bb1d6aa12aa911b94a
- MD5 814f5d6d5a5d19668d38dab6115ff485
- SHA1 bae1139d033a74983a769742695bb78ddff3a48f
- SHA512 4b374daa1700e9fbb3592540625386dfc23d0f49cb29f326aa31df32aabd251606f1b9469129f1ebe9483beff167c07fc81ff074978e1595a05e37d59808783e
- SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYf/:sMguj8Q4VfvJqFTrYK/WytVoVHvUf
- TLSH
  T171388D3233F60532D56352764A8B4002EF31B0577B24CAD7758C63682F4BFB4AAB6B95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution privilege_escalation pyinstaller spyware stealer adware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2