General
- Target 2026-07-29_3eba42c8b14b7d364d5457b8d9569fae_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 60.4MB
- Sample260730-ahj5fshb45
- SHA256 7351f18c08bfa2bb24f3162c25bdc673616b86351d3275cc335aaa371fbe2cd0
- MD5 3eba42c8b14b7d364d5457b8d9569fae
- SHA1 a533e30a7fac42bd67ad8adcd3bb1e2815a6ae15
- SHA512 fa08682152a553b8b9d558b9993d05b741930fe77d56c925fc569a2de41ab346740bf7b96242ca131dfb415e6d7842ec0ede3c54521fd3b5fe35003e6784a26c
- SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfI:fMguj8Q4VfvCqFTrYM
- TLSH T16FD750826240A0D5DC528334959627918593F5333E24FC8EB0DC01D6AFFF69FEAF9668
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_3eba42c8b14b7d364d5457b8d9569fae_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_3eba42c8b14b7d364d5457b8d9569fae_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-29_3eba42c8b14b7d364d5457b8d9569fae_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 60.4MB
- SHA256 7351f18c08bfa2bb24f3162c25bdc673616b86351d3275cc335aaa371fbe2cd0
- MD5 3eba42c8b14b7d364d5457b8d9569fae
- SHA1 a533e30a7fac42bd67ad8adcd3bb1e2815a6ae15
- SHA512 fa08682152a553b8b9d558b9993d05b741930fe77d56c925fc569a2de41ab346740bf7b96242ca131dfb415e6d7842ec0ede3c54521fd3b5fe35003e6784a26c
- SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfI:fMguj8Q4VfvCqFTrYM
- TLSH T16FD750826240A0D5DC528334959627918593F5333E24FC8EB0DC01D6AFFF69FEAF9668
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Executes dropped EXE