xmrig | d4a094f2c436a2bdba68ec6fee32c2a98b5a2f5949df99faf21163e2a653602a

General

Target
2026-08-22_d7336f677fdb6568a485ead3961d3844_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
Size 65.5MB
Sample260822-3dd2vs1ake
SHA256 d4a094f2c436a2bdba68ec6fee32c2a98b5a2f5949df99faf21163e2a653602a
MD5 d7336f677fdb6568a485ead3961d3844
SHA1 78201441df5fc69e58b8f7f9ee5c2e0e7a2118f5
SHA512 217fe02db2acbc0ca341d70c3325c1fcc6639f24b58fa4a07369d29b96100d0795bfac2cac43bafb92e93ffda89ebe9e3c6f8795f26a9d50f061c254eb3cb3e6
SSDEEP 393216:x1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfJ:xMguj8Q4Vfv6qFTrYF
TLSH
T19CE79E3722B714ADF4B6D932C1661106CE3A39175339D6CF718C62B52FAB6E44E39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-22_d7336f677fdb6568a485ead3961d3844_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 65.5MB
- SHA256 d4a094f2c436a2bdba68ec6fee32c2a98b5a2f5949df99faf21163e2a653602a
- MD5 d7336f677fdb6568a485ead3961d3844
- SHA1 78201441df5fc69e58b8f7f9ee5c2e0e7a2118f5
- SHA512 217fe02db2acbc0ca341d70c3325c1fcc6639f24b58fa4a07369d29b96100d0795bfac2cac43bafb92e93ffda89ebe9e3c6f8795f26a9d50f061c254eb3cb3e6
- SSDEEP 393216:x1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfJ:xMguj8Q4Vfv6qFTrYF
- TLSH
  T19CE79E3722B714ADF4B6D932C1661106CE3A39175339D6CF718C62B52FAB6E44E39B20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2