Extracted

• • Target
    2026-09-04_ba5dcb07b0ec370a624109f24acdd9b8_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
  • Size 36.0MB
  • SHA256 e25ba80d009e62294983debeb13148b7c7abcede2156c5359db1094e9bebdff6
  • MD5 ba5dcb07b0ec370a624109f24acdd9b8
  • SHA1 961cd39ce60d00ca57278ba098316ad211ef4095
  • SHA512 7eef6a7db7814441c0e75437154dd6afe187a706abf373fbafc2a086cdda05fe6c386f820f6393185b19d6f85ea5c5ea7e6290c5c9b46d06478cd733353ac776
  • SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfM:fMguj8Q4VfvuqFTrYs
  • TLSH
    T193878B0773E60095E9B7D1388AA65507D773B8638331CBDF329D06152FABAD09A7E720
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2