General
- Target 2026-07-31_6a5f7665d6b9e7eb5a3a6dfb19d890d7_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 60.4MB
- Sample260731-ezyfmatfmg
- SHA256 e81b67b69065151c7b5bdc8f40ff92d7171063cbac01fb11894b24079cf153b2
- MD5 6a5f7665d6b9e7eb5a3a6dfb19d890d7
- SHA1 9ffcc8b155298ca1b5ae305f4ca963e339f7a9bb
- SHA512 14811d4984be7539d918b7141a270510d5ab2c4df1cdc62b79c772c37b8556947817f4e86529d6e56de0acd3e79ed4559ffc26296357c4d1766871478df05711
- SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfF:fMguj8Q4VfvCqFTrYR
- TLSH T1F5D750826240A0D5DC528334959627918593F5333E24FC8EB0DC01D6AFFF69FEAF9668
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_6a5f7665d6b9e7eb5a3a6dfb19d890d7_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_6a5f7665d6b9e7eb5a3a6dfb19d890d7_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-31_6a5f7665d6b9e7eb5a3a6dfb19d890d7_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 60.4MB
- SHA256 e81b67b69065151c7b5bdc8f40ff92d7171063cbac01fb11894b24079cf153b2
- MD5 6a5f7665d6b9e7eb5a3a6dfb19d890d7
- SHA1 9ffcc8b155298ca1b5ae305f4ca963e339f7a9bb
- SHA512 14811d4984be7539d918b7141a270510d5ab2c4df1cdc62b79c772c37b8556947817f4e86529d6e56de0acd3e79ed4559ffc26296357c4d1766871478df05711
- SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfF:fMguj8Q4VfvCqFTrYR
- TLSH T1F5D750826240A0D5DC528334959627918593F5333E24FC8EB0DC01D6AFFF69FEAF9668
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Executes dropped EXE