2ea195102f155ffc4fde3a1ac4a818ae286f0910994681473ba482cf05e74b47

General

Target
2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_zxxz
Size 41.3MB
Sample260905-2g6evatfma
SHA256 2ea195102f155ffc4fde3a1ac4a818ae286f0910994681473ba482cf05e74b47
MD5 9b47ecd98ae0e3734a38db77bd3acb3d
SHA1 3cc68fabde828f6cdfc1a9b47572dd2b5519ac17
SHA512 1ceb49dc513a83b8c6df174367bb577b3d53f6f08d0de4169a3c87bd43ea4cc141e4c1ba06436d0ec111f4ff099b40479f3e2f53aeb24598b5eba2015f509f6f
SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYff:sMguj8Q4VfvHqFTrYaBPtR
TLSH
T136979C0772E601A5E5B3E1388AA74503D773B4674331DACF329D06552FABAE09A7F720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_zxxz
- Size 41.3MB
- SHA256 2ea195102f155ffc4fde3a1ac4a818ae286f0910994681473ba482cf05e74b47
- MD5 9b47ecd98ae0e3734a38db77bd3acb3d
- SHA1 3cc68fabde828f6cdfc1a9b47572dd2b5519ac17
- SHA512 1ceb49dc513a83b8c6df174367bb577b3d53f6f08d0de4169a3c87bd43ea4cc141e4c1ba06436d0ec111f4ff099b40479f3e2f53aeb24598b5eba2015f509f6f
- SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYff:sMguj8Q4VfvHqFTrYaBPtR
- TLSH
  T136979C0772E601A5E5B3E1388AA74503D773B4674331DACF329D06552FABAE09A7F720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2