General
- Target 2026-09-08_ed40a834aa5c7a2db54a756eed7ba697_byakugan_cobalt-strike_coinminer_glassworm_http-browser_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 97.5MB
- Sample260910-cbwk1see92
- SHA256 599e21567db9ccfa7931a1851cbaa7a33169350d110b3f68d3d913e139e44f28
- MD5 ed40a834aa5c7a2db54a756eed7ba697
- SHA1 a51d18bfcb3a164e665c2c6e8ac63b446b742805
- SHA512 099ef63bee7c3c436c58456a6f131b9383b25ee9efe82de3b2c03efa265a6bc3130d8b05aeaff28ac2e57e91414b0b54048308e735e5ef5a3e09c78f795d9409
- SSDEEP 1572864:fiAQIHykHWwiWayZcpjKm77E8MPp8lTDhIiSIOqs8feBYrRKud:PykHfiPyZcpmOI84klPsxBosud
- TLSH T10928F00773E601D5E9B7D1388AA64507D773B8638731CADF329D06152FABAD09A3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-08_ed40a834aa5c7a2db54a756eed7ba697_byakugan_cobalt-strike_coinminer_glassworm_http-browser_.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-08_ed40a834aa5c7a2db54a756eed7ba697_byakugan_cobalt-strike_coinminer_glassworm_http-browser_.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-08_ed40a834aa5c7a2db54a756eed7ba697_byakugan_cobalt-strike_coinminer_glassworm_http-browser_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 97.5MB
- SHA256 599e21567db9ccfa7931a1851cbaa7a33169350d110b3f68d3d913e139e44f28
- MD5 ed40a834aa5c7a2db54a756eed7ba697
- SHA1 a51d18bfcb3a164e665c2c6e8ac63b446b742805
- SHA512 099ef63bee7c3c436c58456a6f131b9383b25ee9efe82de3b2c03efa265a6bc3130d8b05aeaff28ac2e57e91414b0b54048308e735e5ef5a3e09c78f795d9409
- SSDEEP 1572864:fiAQIHykHWwiWayZcpjKm77E8MPp8lTDhIiSIOqs8feBYrRKud:PykHfiPyZcpmOI84klPsxBosud
- TLSH T10928F00773E601D5E9B7D1388AA64507D773B8638731CADF329D06152FABAD09A3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL