0418692dfc8e114d76eab0ca18e47d68a424a699b24f92f1f69f2e227020df47

General

Target
2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
Size 65.3MB
Sample260820-h2rbwasarg
SHA256 0418692dfc8e114d76eab0ca18e47d68a424a699b24f92f1f69f2e227020df47
MD5 47043a0fd2b7f688a726dcd0878d7b33
SHA1 19ac52d6035f4df22623e9b777b27838802f73a9
SHA512 f2530b5fc4c060d499ac81f8ffd53f3031722a605e1e770a64e6ff6fac3160715bf47cdbe134b32cc3f74948956da118d256cc03d9c9f0832908c921b47094f6
SSDEEP 393216:y1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfe:yMguj8Q4VfvQqFTrYI
TLSH
T133E79E3722B714ADF4B6D932C1661106CE3A39175339D6CF718C62B52FAB6E44E39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 65.3MB
- SHA256 0418692dfc8e114d76eab0ca18e47d68a424a699b24f92f1f69f2e227020df47
- MD5 47043a0fd2b7f688a726dcd0878d7b33
- SHA1 19ac52d6035f4df22623e9b777b27838802f73a9
- SHA512 f2530b5fc4c060d499ac81f8ffd53f3031722a605e1e770a64e6ff6fac3160715bf47cdbe134b32cc3f74948956da118d256cc03d9c9f0832908c921b47094f6
- SSDEEP 393216:y1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfe:yMguj8Q4VfvQqFTrYI
- TLSH
  T133E79E3722B714ADF4B6D932C1661106CE3A39175339D6CF718C62B52FAB6E44E39B20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2