vryxen | ca8b822cf8b513dc56edf481eedb3028309fd1a62c78b28f4be5cfdf1cb085c0

General

Target
2026-07-20_a4d7684bc6e02a3b526c2fff1698f091_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
Size 10.7MB
Sample260720-xqqnjadz91
SHA256 ca8b822cf8b513dc56edf481eedb3028309fd1a62c78b28f4be5cfdf1cb085c0
MD5 a4d7684bc6e02a3b526c2fff1698f091
SHA1 95f75727ccfa79923d1e92b6e41bb563d6fa25d2
SHA512 85a3dfe98fc0f4a6a49af337a15b10abffce8ff54cddef9df6dd1e8573835be86f74500a623d764d2cf7f64322e67c3e6b826ad04cdf10ed3c8fc1f3430feb77
SSDEEP 98304:4nA+J7JEbxaY1+Rj958xUyIrxL8EYhN8lpIE:4nPEImIPYUB
TLSH
T1C5B63947ECA515E4C0EED175CA279552BBB13C894B2063D72B90F7292F36BD0AEB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-20_a4d7684bc6e02a3b526c2fff1698f091_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
- Size 10.7MB
- SHA256 ca8b822cf8b513dc56edf481eedb3028309fd1a62c78b28f4be5cfdf1cb085c0
- MD5 a4d7684bc6e02a3b526c2fff1698f091
- SHA1 95f75727ccfa79923d1e92b6e41bb563d6fa25d2
- SHA512 85a3dfe98fc0f4a6a49af337a15b10abffce8ff54cddef9df6dd1e8573835be86f74500a623d764d2cf7f64322e67c3e6b826ad04cdf10ed3c8fc1f3430feb77
- SSDEEP 98304:4nA+J7JEbxaY1+Rj958xUyIrxL8EYhN8lpIE:4nPEImIPYUB
- TLSH
  T1C5B63947ECA515E4C0EED175CA279552BBB13C894B2063D72B90F7292F36BD0AEB9700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution vryxen persistence spyware stealer trojan
- Detects Vryxen stealer
- Family: Vryxen
  Vryxen is an open-source stealer written in Golang.
  stealer vryxen
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2