6a119b0cab62804bafbc676a01da47b6a551497960d68134bb2da2aae48b6770

General

Target
2026-07-14_bf522ad68e9057b65124a21a626b06fb_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 15.6MB
Sample260714-m7le2adw9v
SHA256 6a119b0cab62804bafbc676a01da47b6a551497960d68134bb2da2aae48b6770
MD5 bf522ad68e9057b65124a21a626b06fb
SHA1 74ae1da9219b88aa55cfb0b88a18cf9f2680bba3
SHA512 038ea4461f6a858a68d7a95faed8b7f9dff145d77ea15f662d83be4dba53f848e02b1d99f777524bd3d8c6beb7eb395d1ef49801a6c5194381542ebfd0c927cc
SSDEEP 196608:VtycmTqRXPBbAzATNiutS4mtrVExU0vpiTmgYKNxEGX3:Vtycm2XAaNHtwZmxvpRgL3
TLSH
T186F68C43E8714695D0EDA276CA678653BA353C845B3163C76BA0F7382F73BD0AAB5700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-14_bf522ad68e9057b65124a21a626b06fb_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 15.6MB
- SHA256 6a119b0cab62804bafbc676a01da47b6a551497960d68134bb2da2aae48b6770
- MD5 bf522ad68e9057b65124a21a626b06fb
- SHA1 74ae1da9219b88aa55cfb0b88a18cf9f2680bba3
- SHA512 038ea4461f6a858a68d7a95faed8b7f9dff145d77ea15f662d83be4dba53f848e02b1d99f777524bd3d8c6beb7eb395d1ef49801a6c5194381542ebfd0c927cc
- SSDEEP 196608:VtycmTqRXPBbAzATNiutS4mtrVExU0vpiTmgYKNxEGX3:Vtycm2XAaNHtwZmxvpRgL3
- TLSH
  T186F68C43E8714695D0EDA276CA678653BA353C845B3163C76BA0F7382F73BD0AAB5700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery persistence spyware stealer trojan
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2