56c78979bb6b3a2d1748e8eb8c5e67610484f80a5f3ceceae8ef0cf635f7932e

General

Target
2026-08-05_a2df4c43c533340fd311940402c45181_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
Size 114.7MB
Sample260805-ddkrzaaj7t
SHA256 56c78979bb6b3a2d1748e8eb8c5e67610484f80a5f3ceceae8ef0cf635f7932e
MD5 a2df4c43c533340fd311940402c45181
SHA1 cb258a3720c330a99852bd9e1168afdc98b71583
SHA512 03382c7e13531bdacc21da35200337c4e558f6e6f8db2fce757413b0e44ece81627aca90659dacaae76d80d45aea97c4601fab270cfbee3b98e2f681b13897e7
SSDEEP 3145728:D5BHkHaoMl9xjywd6KVMlEzYvcHBn86N4LOIWmNr:ldkvMlX5zMlHchntIJNr
TLSH
T14148010733E60195E5B7E2388AA79513D773B86383318BDF319D06151FABAD09A7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-08-05_a2df4c43c533340fd311940402c45181_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 114.7MB
- SHA256 56c78979bb6b3a2d1748e8eb8c5e67610484f80a5f3ceceae8ef0cf635f7932e
- MD5 a2df4c43c533340fd311940402c45181
- SHA1 cb258a3720c330a99852bd9e1168afdc98b71583
- SHA512 03382c7e13531bdacc21da35200337c4e558f6e6f8db2fce757413b0e44ece81627aca90659dacaae76d80d45aea97c4601fab270cfbee3b98e2f681b13897e7
- SSDEEP 3145728:D5BHkHaoMl9xjywd6KVMlEzYvcHBn86N4LOIWmNr:ldkvMlX5zMlHchntIJNr
- TLSH
  T14148010733E60195E5B7E2388AA79513D773B86383318BDF319D06151FABAD09A7E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution spyware stealer
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Suspicious use of SetThreadContext
behavioral1