af7c02d3be0da9456438940f0ee83f486fd9071e1122c4092b6063793f1f2901

General

Target
2026-07-09_7a949fd7da0da121b6d015e48713fa9b_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_ngrbot_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 9.1MB
Sample260709-cjg3labx4k
SHA256 af7c02d3be0da9456438940f0ee83f486fd9071e1122c4092b6063793f1f2901
MD5 7a949fd7da0da121b6d015e48713fa9b
SHA1 c5d1c2140ca1b0a55648158b80aa197471b7945d
SHA512 9533b7f96293aef5559b8af1e31a785307e65a9794d7d380cb5264c8729a6fa1c5368b329b921ef1ffd23dbf320d93ed29b7d4d07c6bb3cbb2e2fe66c0e5093c
SSDEEP 98304:xPIVgwz2hR6t2RskuiwBUCq6FGEfk2JRxroT:z+2hRFuiwinGj0T
TLSH
T11AA63907ECA580A4C4AED5348A629227BE717C489F3027D33B90F7652F77BD0A9B9744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-09_7a949fd7da0da121b6d015e48713fa9b_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_ngrbot_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 9.1MB
- SHA256 af7c02d3be0da9456438940f0ee83f486fd9071e1122c4092b6063793f1f2901
- MD5 7a949fd7da0da121b6d015e48713fa9b
- SHA1 c5d1c2140ca1b0a55648158b80aa197471b7945d
- SHA512 9533b7f96293aef5559b8af1e31a785307e65a9794d7d380cb5264c8729a6fa1c5368b329b921ef1ffd23dbf320d93ed29b7d4d07c6bb3cbb2e2fe66c0e5093c
- SSDEEP 98304:xPIVgwz2hR6t2RskuiwBUCq6FGEfk2JRxroT:z+2hRFuiwinGj0T
- TLSH
  T11AA63907ECA580A4C4AED5348A629227BE717C489F3027D33B90F7652F77BD0A9B9744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables containing possible sandbox system UUIDs
- Detects executables referencing virtualization MAC addresses
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2