General
- Target 2026-08-21_e4bcff9dfdeb0235ab79f644fcca01ee_avaddon_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_pos_satacom_stealc_vidar_zxxz
- Size 72.3MB
- Sample260821-ec5lesfr7s
- SHA256 ecee6e567473ad56db828fedc4574ecb525a1c0061b6c14021befe1f1cb33b8e
- MD5 e4bcff9dfdeb0235ab79f644fcca01ee
- SHA1 ba6faa3616ffc6a3592a2d8a4d2c1151357212bd
- SHA512 de44b09d00e7d9bf8baff439e55fe510e70b63acadab8e68698eff8c268181acd1d110e1f7c70dd57de9f168006319dc2b1dc0d825827ae7b2f5bb064efe0d55
- SSDEEP 393216:i1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfc:iMguj8Q4VfvCqFTrYTTN+ZRp
- TLSH T18EF7BD06B3E505A3D5A792348A9B0207E3B2B4635730DBDB719C43582FAB7E48A7F750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
10 signatures
Behavioral task
behavioral1
Sample
2026-08-21_e4bcff9dfdeb0235ab79f644fcca01ee_avaddon_byakugan_cobalt-strike_coinminer_glassworm_icedi.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_e4bcff9dfdeb0235ab79f644fcca01ee_avaddon_byakugan_cobalt-strike_coinminer_glassworm_icedi.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-21_e4bcff9dfdeb0235ab79f644fcca01ee_avaddon_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_pos_satacom_stealc_vidar_zxxz
- Size 72.3MB
- SHA256 ecee6e567473ad56db828fedc4574ecb525a1c0061b6c14021befe1f1cb33b8e
- MD5 e4bcff9dfdeb0235ab79f644fcca01ee
- SHA1 ba6faa3616ffc6a3592a2d8a4d2c1151357212bd
- SHA512 de44b09d00e7d9bf8baff439e55fe510e70b63acadab8e68698eff8c268181acd1d110e1f7c70dd57de9f168006319dc2b1dc0d825827ae7b2f5bb064efe0d55
- SSDEEP 393216:i1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfc:iMguj8Q4VfvCqFTrYTTN+ZRp
- TLSH T18EF7BD06B3E505A3D5A792348A9B0207E3B2B4635730DBDB719C43582FAB7E48A7F750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.