73cfd71614c631dd849c115f0c7782315d92082d1596e4e995be685ad5e786d5

General

Target
2026-07-04_7dca76c1ba890fdd36d18fb820a77d44_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
Size 36.4MB
Sample260704-c7d1vaav4y
SHA256 73cfd71614c631dd849c115f0c7782315d92082d1596e4e995be685ad5e786d5
MD5 7dca76c1ba890fdd36d18fb820a77d44
SHA1 aa1afa445324d3f569e28e7ff9e95c5d52c1166b
SHA512 ad74135d55794136fcd57511b23a8bc96b0e86932797c7c2d5ed801d55e9a722ed009e2735f608b649a27cc4208fb10626c1a2bba3b3bcde21abcc315b085b69
SSDEEP 393216:x1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYf5:xMguj8Q4VfvjqFTrYa
TLSH
T1DA878B0773E61095E5B3D238CAA74503D7B3B8675331DADF329D06152FABAD49A3A320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-07-04_7dca76c1ba890fdd36d18fb820a77d44_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 36.4MB
- SHA256 73cfd71614c631dd849c115f0c7782315d92082d1596e4e995be685ad5e786d5
- MD5 7dca76c1ba890fdd36d18fb820a77d44
- SHA1 aa1afa445324d3f569e28e7ff9e95c5d52c1166b
- SHA512 ad74135d55794136fcd57511b23a8bc96b0e86932797c7c2d5ed801d55e9a722ed009e2735f608b649a27cc4208fb10626c1a2bba3b3bcde21abcc315b085b69
- SSDEEP 393216:x1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYf5:xMguj8Q4VfvjqFTrYa
- TLSH
  T1DA878B0773E61095E5B3D238CAA74503D7B3B8675331DADF329D06152FABAD49A3A320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2