General
- Target 2026-08-13_9bc153a2a82e14b2b1e5652d35782026_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 55.4MB
- Sample260813-kkbk7st1ct
- SHA256 a811f916ce8750368e3ffb9f41c4f1b9deed91decc19b0a19adb3a8725bd9f9d
- MD5 9bc153a2a82e14b2b1e5652d35782026
- SHA1 242641e52e771c4a138052a5c7ecb8538636eebe
- SHA512 978a1128ef64bb4e03150029f5640d7343f69373ad6b7fb6d284b1b68ebf88e2a7da03d012fb5802eac82503a73fabd190859a44d18942efd7b6a7aaa49269d1
- SSDEEP 786432:fMguj8Q4VfvCqFTrY7WmXaDMItMICzgp2Wwj9LZPmGb3qRRek:fiAQIHCkHqWmXMMIOIC+QLZPmGb3Cf
- TLSH T121D7CE0773E601A5E5B7E2388AA75513D773B46343318BDF329D06151FABAE09A7E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-13_9bc153a2a82e14b2b1e5652d35782026_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_9bc153a2a82e14b2b1e5652d35782026_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-13_9bc153a2a82e14b2b1e5652d35782026_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 55.4MB
- SHA256 a811f916ce8750368e3ffb9f41c4f1b9deed91decc19b0a19adb3a8725bd9f9d
- MD5 9bc153a2a82e14b2b1e5652d35782026
- SHA1 242641e52e771c4a138052a5c7ecb8538636eebe
- SHA512 978a1128ef64bb4e03150029f5640d7343f69373ad6b7fb6d284b1b68ebf88e2a7da03d012fb5802eac82503a73fabd190859a44d18942efd7b6a7aaa49269d1
- SSDEEP 786432:fMguj8Q4VfvCqFTrY7WmXaDMItMICzgp2Wwj9LZPmGb3qRRek:fiAQIHCkHqWmXMMIOIC+QLZPmGb3Cf
- TLSH T121D7CE0773E601A5E5B7E2388AA75513D773B46343318BDF329D06151FABAE09A7E320
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.