126336201f29cdc989dbf38d2dc745f9f66296e4a54b60aa5d247ee2eb336205

General

Target
2026-07-03_88fc79d9b33b786dbd4a4f953526d874_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
Size 36.4MB
Sample260703-hd4bjacw5y
SHA256 126336201f29cdc989dbf38d2dc745f9f66296e4a54b60aa5d247ee2eb336205
MD5 88fc79d9b33b786dbd4a4f953526d874
SHA1 c9fb8bd6421a1b4ece06cebb1a33c55c872f9a8e
SHA512 92b3a91a118a6522ac44726f0b29bea77070c40f42e2e09704bd9a1bde65d41d0325104e733f4d15f548e1b0f6b3fa48032149e360078a8f07c900b85c6bde0c
SSDEEP 393216:x1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfc:xMguj8Q4VfvQqFTrY+
TLSH
T194878C0773E600A5E5B3D1788AA68503D7B3B4A35331DBDF729D06151FABAD09A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-07-03_88fc79d9b33b786dbd4a4f953526d874_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 36.4MB
- SHA256 126336201f29cdc989dbf38d2dc745f9f66296e4a54b60aa5d247ee2eb336205
- MD5 88fc79d9b33b786dbd4a4f953526d874
- SHA1 c9fb8bd6421a1b4ece06cebb1a33c55c872f9a8e
- SHA512 92b3a91a118a6522ac44726f0b29bea77070c40f42e2e09704bd9a1bde65d41d0325104e733f4d15f548e1b0f6b3fa48032149e360078a8f07c900b85c6bde0c
- SSDEEP 393216:x1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfc:xMguj8Q4VfvQqFTrY+
- TLSH
  T194878C0773E600A5E5B3D1788AA68503D7B3B4A35331DBDF729D06151FABAD09A7E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2