General
- Target 2026-08-24_d700b462092dbb0e87252a431eb415f7_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_zxxz
- Size 60.4MB
- Sample260824-3lapeafd72
- SHA256 8ef91cbb3ec1eb479ce00c4661e19f6e9e7fb3be97a02be63608cbcd63c51280
- MD5 d700b462092dbb0e87252a431eb415f7
- SHA1 7d97f5008f63200b3b188b48e36baa1d8904294f
- SHA512 72a4377f036fd3e02d3e62d4eb7943e66a4fa50e6805987133235d8e03816f04123a3bbb73bb7624bf4f3edcf2433a8125901b8366e5660d79e3c2b6f77e2159
- SSDEEP 786432:CMguj8Q4VfvhqFTrYCorUyA02wD6O2qIvEJcX36/SldAif:CiAQIHhkHWrR8wD6O2XIcXq/SjAE
- TLSH T1D0D7CE0773E60095E9B7D1388AA75507D773B8638331CADF329D06152FABAD09A7E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-24_d700b462092dbb0e87252a431eb415f7_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-08-24_d700b462092dbb0e87252a431eb415f7_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-08-24_d700b462092dbb0e87252a431eb415f7_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_zxxz
- Size 60.4MB
- SHA256 8ef91cbb3ec1eb479ce00c4661e19f6e9e7fb3be97a02be63608cbcd63c51280
- MD5 d700b462092dbb0e87252a431eb415f7
- SHA1 7d97f5008f63200b3b188b48e36baa1d8904294f
- SHA512 72a4377f036fd3e02d3e62d4eb7943e66a4fa50e6805987133235d8e03816f04123a3bbb73bb7624bf4f3edcf2433a8125901b8366e5660d79e3c2b6f77e2159
- SSDEEP 786432:CMguj8Q4VfvhqFTrYCorUyA02wD6O2qIvEJcX36/SldAif:CiAQIHhkHWrR8wD6O2XIcXq/SjAE
- TLSH T1D0D7CE0773E60095E9B7D1388AA75507D773B8638331CADF329D06152FABAD09A7E720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Overlord RAT
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2