ec63c1f1228056edde17115937247522e653c792635d8375d580d5e57a8f5aba

General

Target
2026-07-05_83af7208117051a98e3813e5f116e78d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_zxxz
Size 43.2MB
Sample260705-btk2kaf14w
SHA256 ec63c1f1228056edde17115937247522e653c792635d8375d580d5e57a8f5aba
MD5 83af7208117051a98e3813e5f116e78d
SHA1 721c90bde24576ae784950cbd3c0cd876c93fc4a
SHA512 d3600ccdc11affdbc6df63b824f8b515c77fc18ec0e48648c80867bf6d93563147ebd2cecbe70cb4ec6a085558fb284ccbb9a468e55ae65b18cb20771f3d6413
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfa:fMguj8Q4VfvFqFTrYr
TLSH
T102A78C0773EA01A5E5B3E1388AA74103D773B4675731CBDB329D02552FABAE09A7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-05_83af7208117051a98e3813e5f116e78d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_zxxz
- Size 43.2MB
- SHA256 ec63c1f1228056edde17115937247522e653c792635d8375d580d5e57a8f5aba
- MD5 83af7208117051a98e3813e5f116e78d
- SHA1 721c90bde24576ae784950cbd3c0cd876c93fc4a
- SHA512 d3600ccdc11affdbc6df63b824f8b515c77fc18ec0e48648c80867bf6d93563147ebd2cecbe70cb4ec6a085558fb284ccbb9a468e55ae65b18cb20771f3d6413
- SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfa:fMguj8Q4VfvFqFTrYr
- TLSH
  T102A78C0773EA01A5E5B3E1388AA74103D773B4675731CBDB329D02552FABAE09A7E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion execution persistence privilege_escalation spyware stealer adware discovery ransomware
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2