518d535a0ede24ae80bc658c7f73e96a6b47293d8e7b610c7c2f0e79a15e72bc

General

Target
2026-07-07_f87ac4e5499dafbbbc467489d3ba7472_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
Size 65.3MB
Sample260707-hhcdlsgx5n
SHA256 518d535a0ede24ae80bc658c7f73e96a6b47293d8e7b610c7c2f0e79a15e72bc
MD5 f87ac4e5499dafbbbc467489d3ba7472
SHA1 c6da6c877bdf4a96784c0267c19d02b9fb86863b
SHA512 17dcff665051c83c58b4987c8dce3eb9fa1bad0789d81bf7c6356edb9fc18ab6ff6c8d65c8d0f349632b94a3021ac7a82207a0699bf51c78046839655b927711
SSDEEP 393216:i1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfh:iMguj8Q4VfvYqFTrYf
TLSH
T168E79E3722B714ADF4B6D93281661106CE3A39175339D6CF718C62B52FBB6E44E39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-07-07_f87ac4e5499dafbbbc467489d3ba7472_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 65.3MB
- SHA256 518d535a0ede24ae80bc658c7f73e96a6b47293d8e7b610c7c2f0e79a15e72bc
- MD5 f87ac4e5499dafbbbc467489d3ba7472
- SHA1 c6da6c877bdf4a96784c0267c19d02b9fb86863b
- SHA512 17dcff665051c83c58b4987c8dce3eb9fa1bad0789d81bf7c6356edb9fc18ab6ff6c8d65c8d0f349632b94a3021ac7a82207a0699bf51c78046839655b927711
- SSDEEP 393216:i1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfh:iMguj8Q4VfvYqFTrYf
- TLSH
  T168E79E3722B714ADF4B6D93281661106CE3A39175339D6CF718C62B52FBB6E44E39B20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2