99d678d6790804dacc7fcf140ab7684d05d9754bd6fac330aecd6e332387a6b3

General

Target
2026-08-03_2b7332f7ab1ee1be8d7f2c13f28dd44b_amadey_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar_zxxz
Size 66.4MB
Sample260804-dm4w7sca98
SHA256 99d678d6790804dacc7fcf140ab7684d05d9754bd6fac330aecd6e332387a6b3
MD5 2b7332f7ab1ee1be8d7f2c13f28dd44b
SHA1 bdc21beefd0233a217015109220dcc616fafb9f9
SHA512 eef772a13a39f5e88e5a4056bd22c6db865d1626fb6d5f8149d277398a2d1e31930c42455bffd8f0316475e3d6a2eb97dc077ee81b04d4ea71886b3f073191f0
SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfF:sMguj8Q4VfvyqFTrY2kfkna+DWgin
TLSH
T16CE7AE0633F506A6D5A392358ADB8102E772B0576734CBCB328C43582FAFBE45E7A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-03_2b7332f7ab1ee1be8d7f2c13f28dd44b_amadey_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar_zxxz
- Size 66.4MB
- SHA256 99d678d6790804dacc7fcf140ab7684d05d9754bd6fac330aecd6e332387a6b3
- MD5 2b7332f7ab1ee1be8d7f2c13f28dd44b
- SHA1 bdc21beefd0233a217015109220dcc616fafb9f9
- SHA512 eef772a13a39f5e88e5a4056bd22c6db865d1626fb6d5f8149d277398a2d1e31930c42455bffd8f0316475e3d6a2eb97dc077ee81b04d4ea71886b3f073191f0
- SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfF:sMguj8Q4VfvyqFTrY2kfkna+DWgin
- TLSH
  T16CE7AE0633F506A6D5A392358ADB8102E772B0576734CBCB328C43582FAFBE45E7A754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2