General
- Target 2026-07-17_fbccc64e01dc09e8eabd2f5f45d138db_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 12.0MB
- Sample260718-brbecabx3n
- SHA256 bbe2db9b351a32786ecd8f22d05bed2ed339a12ae733ea2ad412a5c38e4ccf8b
- MD5 fbccc64e01dc09e8eabd2f5f45d138db
- SHA1 50feee8f99672c4e77fc8c035e100c4c11267d66
- SHA512 79e343a990954dbb493752f93d089c74b41de9ae05da7f617c8cd2dc8a475a5d9f592007d087c84a47fdd19fc19b1f2106868fdfdd96802671a1f31748f06fca
- SSDEEP 98304:KyKqYqsxlyZivS74Venujd0b24i3HVdHEDO/:RYq7EScVJY2TSDO/
- TLSH T1B8C65A11FECB54F1E9035831416BB27F63355D048B28DB9BEB183B6AF87B69118AB305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-17_fbccc64e01dc09e8eabd2f5f45d138db_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_fbccc64e01dc09e8eabd2f5f45d138db_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-17_fbccc64e01dc09e8eabd2f5f45d138db_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 12.0MB
- SHA256 bbe2db9b351a32786ecd8f22d05bed2ed339a12ae733ea2ad412a5c38e4ccf8b
- MD5 fbccc64e01dc09e8eabd2f5f45d138db
- SHA1 50feee8f99672c4e77fc8c035e100c4c11267d66
- SHA512 79e343a990954dbb493752f93d089c74b41de9ae05da7f617c8cd2dc8a475a5d9f592007d087c84a47fdd19fc19b1f2106868fdfdd96802671a1f31748f06fca
- SSDEEP 98304:KyKqYqsxlyZivS74Venujd0b24i3HVdHEDO/:RYq7EScVJY2TSDO/
- TLSH T1B8C65A11FECB54F1E9035831416BB27F63355D048B28DB9BEB183B6AF87B69118AB305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detect SalatStealer payload
-
Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Executes dropped EXE