98e3ac54871d375b42a04422b6fc0a94c02144e158e84894dee05becf3335bb3

General

Target
2026-07-20_dcb4dd17732d4411e1fe8b160b070f6c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
Size 36.1MB
Sample260720-khlndset4z
SHA256 98e3ac54871d375b42a04422b6fc0a94c02144e158e84894dee05becf3335bb3
MD5 dcb4dd17732d4411e1fe8b160b070f6c
SHA1 692766e6c768552c326f5f5a3b73dc3ed927d573
SHA512 44e45955221d563c46cafa3f5ae434a895f44fa1ae0950bccbda0a0188cd9b303d7347e58dec0afc789da81430941d56d03539b8e591dea7358138323b81fd5d
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfP:fMguj8Q4VfvcqFTrYl
TLSH
T169878B0773E60095E9B7D1388AA65507E773B8634331CBDF329D06152FABAD09A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-07-20_dcb4dd17732d4411e1fe8b160b070f6c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 36.1MB
- SHA256 98e3ac54871d375b42a04422b6fc0a94c02144e158e84894dee05becf3335bb3
- MD5 dcb4dd17732d4411e1fe8b160b070f6c
- SHA1 692766e6c768552c326f5f5a3b73dc3ed927d573
- SHA512 44e45955221d563c46cafa3f5ae434a895f44fa1ae0950bccbda0a0188cd9b303d7347e58dec0afc789da81430941d56d03539b8e591dea7358138323b81fd5d
- SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfP:fMguj8Q4VfvcqFTrYl
- TLSH
  T169878B0773E60095E9B7D1388AA65507E773B8634331CBDF329D06152FABAD09A7E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2