3cedbe6c768d7e368210e43637111c7c31f3318b5fff99104e9ef4312d1e1143

General

Target
2026-07-01_c4758542cbfebbf2debf38591f4328d8_coinminer_elex_frostygoop_glassworm_hive_salatstealer_sliver_snatch
Size 4.8MB
Sample260701-jktlcahs3m
SHA256 3cedbe6c768d7e368210e43637111c7c31f3318b5fff99104e9ef4312d1e1143
MD5 c4758542cbfebbf2debf38591f4328d8
SHA1 b47a4666bc330551b265edea0b5f99dac9650c82
SHA512 76608371356b3047ceab19a738a2affb2eb585758a2d6ce9cc551b80b42c7057afe2f60a3719a6bbb2628adb76b8c3423973c6bce40ea90222559955c2471c35
SSDEEP 49152:+H1WhQWeoQuv8BDu6t4KQbCTM6m0D6amirbs/Ebs:+YhQWeoQuv8Nu6tjQ0DWz/
TLSH
T17D367C21FE8754B6E442123258AB63AF23389D050F369B97EB94377DE9772D51C3230A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-01_c4758542cbfebbf2debf38591f4328d8_coinminer_elex_frostygoop_glassworm_hive_salatstealer_sliver_snatch
- Size 4.8MB
- SHA256 3cedbe6c768d7e368210e43637111c7c31f3318b5fff99104e9ef4312d1e1143
- MD5 c4758542cbfebbf2debf38591f4328d8
- SHA1 b47a4666bc330551b265edea0b5f99dac9650c82
- SHA512 76608371356b3047ceab19a738a2affb2eb585758a2d6ce9cc551b80b42c7057afe2f60a3719a6bbb2628adb76b8c3423973c6bce40ea90222559955c2471c35
- SSDEEP 49152:+H1WhQWeoQuv8BDu6t4KQbCTM6m0D6amirbs/Ebs:+YhQWeoQuv8Nu6tjQ0DWz/
- TLSH
  T17D367C21FE8754B6E442123258AB63AF23389D050F369B97EB94377DE9772D51C3230A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery spyware stealer adware persistence ransomware
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2