c1f2983ef4c7262050c181b5693e58ef13f0bb152cb56113fb7e9bd86c9ea402

General

Target
2026-06-25_7b486155dba6f5cd8ca7c3260589d11b_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_zxxz
Size 51.7MB
Sample260629-1eba9agy6l
SHA256 c1f2983ef4c7262050c181b5693e58ef13f0bb152cb56113fb7e9bd86c9ea402
MD5 7b486155dba6f5cd8ca7c3260589d11b
SHA1 d7969803e385ad0e16d8d9f8b391a52a7513f97b
SHA512 e3c3c1549d2dc3e2fc52406bdc59ae28b5288817666055ec50720f9de264da31e009ae0ac994f6d3807c605ca819dfc799a0d015c8800264d6b5bc7ad31e06c8
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfb:fMguj8Q4Vfv3qFTrYpLUhr
TLSH
T174C7AE0673E501A2E5B7E2388BA74103E373B4575731CBDB325C43592FABAE09A7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-06-25_7b486155dba6f5cd8ca7c3260589d11b_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_zxxz
- Size 51.7MB
- SHA256 c1f2983ef4c7262050c181b5693e58ef13f0bb152cb56113fb7e9bd86c9ea402
- MD5 7b486155dba6f5cd8ca7c3260589d11b
- SHA1 d7969803e385ad0e16d8d9f8b391a52a7513f97b
- SHA512 e3c3c1549d2dc3e2fc52406bdc59ae28b5288817666055ec50720f9de264da31e009ae0ac994f6d3807c605ca819dfc799a0d015c8800264d6b5bc7ad31e06c8
- SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfb:fMguj8Q4Vfv3qFTrYpLUhr
- TLSH
  T174C7AE0673E501A2E5B7E2388BA74103E373B4575731CBDB325C43592FABAE09A7A750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery spyware stealer adware persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2