General
- Target 2026-05-04_ca5af93982e9872319c87eea650dfce8_coinminer_dosia_frostygoop_ghostlocker_glassworm_hijackloader_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 12.9MB
- Sample260504-cfpy2aez7l
- SHA256 1b2035a2afa0cac55a0b1f974caa561e6efb0e71f21435c6e65fcc42a006a6f3
- MD5 ca5af93982e9872319c87eea650dfce8
- SHA1 adcddd6cbbaeaade457d07678e609c0bbefde3ac
- SHA512 fa9e2b36c7b7f64e838539d175f1ae5ab3a53227fd91390e1d65a08d904ed05eae517891dcd6de7e7ebb020d8c5ba6db8b95ef8a9d704dcdc468fb0027fdfcac
- SSDEEP 196608:GN7QqOxIF8TpCqUVK1kQrr/SE/kGTbxWnAz:G6qOSGp/kQn/SE/kGTlWnAz
- TLSH T1E5D6C003FCA545A9C0AAD335C5628253BA71BC485B3123D73B60F7396FB6BD46AB9700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-04_ca5af93982e9872319c87eea650dfce8_coinminer_dosia_frostygoop_ghostlocker_glassworm_hijackl.exe
Resource
win10v2004-20260130-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-04_ca5af93982e9872319c87eea650dfce8_coinminer_dosia_frostygoop_ghostlocker_glassworm_hijackl.exe
Resource
win11-20260130-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-04_ca5af93982e9872319c87eea650dfce8_coinminer_dosia_frostygoop_ghostlocker_glassworm_hijackloader_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 12.9MB
- SHA256 1b2035a2afa0cac55a0b1f974caa561e6efb0e71f21435c6e65fcc42a006a6f3
- MD5 ca5af93982e9872319c87eea650dfce8
- SHA1 adcddd6cbbaeaade457d07678e609c0bbefde3ac
- SHA512 fa9e2b36c7b7f64e838539d175f1ae5ab3a53227fd91390e1d65a08d904ed05eae517891dcd6de7e7ebb020d8c5ba6db8b95ef8a9d704dcdc468fb0027fdfcac
- SSDEEP 196608:GN7QqOxIF8TpCqUVK1kQrr/SE/kGTbxWnAz:G6qOSGp/kQn/SE/kGTlWnAz
- TLSH T1E5D6C003FCA545A9C0AAD335C5628253BA71BC485B3123D73B60F7396FB6BD46AB9700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL