8db98003b9d56cacda3561f7cd3187c010532f8f9a8b68caabf933e25a80e162

General

Target
2026-09-04_ac0983b67715eb1e3f002b19cc6d4b93_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
Size 65.3MB
Sample260905-azm8fatcpf
SHA256 8db98003b9d56cacda3561f7cd3187c010532f8f9a8b68caabf933e25a80e162
MD5 ac0983b67715eb1e3f002b19cc6d4b93
SHA1 9d071e5b713cc100a2885f1102943ca082bd8057
SHA512 8df4f8f40c95c90ab8596a4ed5330f099a6ec2628e575c268b9ba54d2756b38e4695837d9ecac2b13ae378bbe2287638e1bf17a5b2db4763bc9db9a5115da9e9
SSDEEP 393216:i1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfz:iMguj8Q4VfvUqFTrYp
TLSH
T1A3E79E3722B714ADF4B6D932C1661106CE3A39175339D6CF718C62B52FAB6E44E39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-09-04_ac0983b67715eb1e3f002b19cc6d4b93_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 65.3MB
- SHA256 8db98003b9d56cacda3561f7cd3187c010532f8f9a8b68caabf933e25a80e162
- MD5 ac0983b67715eb1e3f002b19cc6d4b93
- SHA1 9d071e5b713cc100a2885f1102943ca082bd8057
- SHA512 8df4f8f40c95c90ab8596a4ed5330f099a6ec2628e575c268b9ba54d2756b38e4695837d9ecac2b13ae378bbe2287638e1bf17a5b2db4763bc9db9a5115da9e9
- SSDEEP 393216:i1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfz:iMguj8Q4VfvUqFTrYp
- TLSH
  T1A3E79E3722B714ADF4B6D932C1661106CE3A39175339D6CF718C62B52FAB6E44E39B20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2