d3758b71b982d9b8e0111af9296d754c61ca5e8cbb153cf49e1e6d5173d193a1

General

Target
2026-08-21_0e50b6bf67c6ead7d9a0357e4a651975_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_zxxz
Size 51.5MB
Sample260822-xtny4stsbx
SHA256 d3758b71b982d9b8e0111af9296d754c61ca5e8cbb153cf49e1e6d5173d193a1
MD5 0e50b6bf67c6ead7d9a0357e4a651975
SHA1 9626f3544dc654d72eafdb07c3b3b9b380f165ea
SHA512 df117fb34765906f007a1ce4ee45cedb41f2069b3fe9604e3af119b596821560540dd3052cd18e59d91c49313eec7369a89abb4216a9f43c32b9f6129604718f
SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfu:sMguj8Q4Vfv0qFTrYE
TLSH
T1AAC78D0273E605A2E5B391398A9B4103E772B4575735CBDB324C43242FABFE49A7B760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-21_0e50b6bf67c6ead7d9a0357e4a651975_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_zxxz
- Size 51.5MB
- SHA256 d3758b71b982d9b8e0111af9296d754c61ca5e8cbb153cf49e1e6d5173d193a1
- MD5 0e50b6bf67c6ead7d9a0357e4a651975
- SHA1 9626f3544dc654d72eafdb07c3b3b9b380f165ea
- SHA512 df117fb34765906f007a1ce4ee45cedb41f2069b3fe9604e3af119b596821560540dd3052cd18e59d91c49313eec7369a89abb4216a9f43c32b9f6129604718f
- SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfu:sMguj8Q4Vfv0qFTrYE
- TLSH
  T1AAC78D0273E605A2E5B391398A9B4103E772B4575735CBDB324C43242FABFE49A7B760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2