General
- Target 2026-08-21_c5e654488b22ba81dc93cdaf543e0c6d_avaddon_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_pos_satacom_stealc_vidar_zxxz
- Size 72.7MB
- Sample260821-ehrazshe64
- SHA256 7d3243db95feec7619d82d609d4ccc9657cccd4d08f2eb617155a10e0525ade6
- MD5 c5e654488b22ba81dc93cdaf543e0c6d
- SHA1 a108efa58682770bb3591c2792f24bd671b83c9e
- SHA512 739adba9e46a632942b1110e961728f847d11fd8b559fe4158192d24cba31e0a64d865a669841d5d59dc7506028fd087d9d2d107d9ade8ee21851cdf03343d9d
- SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfB:fMguj8Q4VfveqFTrYMfNvmXnAw
- TLSH T13AF7BE06B3E505A3D6A792348A9B0207E372B4635730DBDB719C43182FEB7E49A7B750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
11 signatures
Behavioral task
behavioral1
Sample
2026-08-21_c5e654488b22ba81dc93cdaf543e0c6d_avaddon_byakugan_cobalt-strike_coinminer_glassworm_icedi.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_c5e654488b22ba81dc93cdaf543e0c6d_avaddon_byakugan_cobalt-strike_coinminer_glassworm_icedi.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-21_c5e654488b22ba81dc93cdaf543e0c6d_avaddon_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_pos_satacom_stealc_vidar_zxxz
- Size 72.7MB
- SHA256 7d3243db95feec7619d82d609d4ccc9657cccd4d08f2eb617155a10e0525ade6
- MD5 c5e654488b22ba81dc93cdaf543e0c6d
- SHA1 a108efa58682770bb3591c2792f24bd671b83c9e
- SHA512 739adba9e46a632942b1110e961728f847d11fd8b559fe4158192d24cba31e0a64d865a669841d5d59dc7506028fd087d9d2d107d9ade8ee21851cdf03343d9d
- SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfB:fMguj8Q4VfveqFTrYMfNvmXnAw
- TLSH T13AF7BE06B3E505A3D6A792348A9B0207E372B4635730DBDB719C43182FEB7E49A7B750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Loads dropped DLL
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.