Extracted

Extracted

• • Target
    2026-08-21_ec7d7098109e56390c3a8536034eeddd_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
  • Size 36.0MB
  • SHA256 33922a708dbd6b6f7a5512d5dff1b7ed2b51e13962829146962aca9a2d65b5a7
  • MD5 ec7d7098109e56390c3a8536034eeddd
  • SHA1 2b61de7fa181f4111bed383182795d4d7d56e511
  • SHA512 1baeeb8f676cf655b2c4fe2f9f13cd2831f7f035bd631741ff44026782ebb08304145b8a4eaef0d975e84d20e0fe9b6f81277284d069fff79dacf6bb7068f080
  • SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfg:fMguj8Q4VfvDqFTrY9
  • TLSH
    T189878B0773E60095E9B7D1388AA65507D773B8638331CBDF329D06152FABAD09A7E720
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral1behavioral2