74a733cd187e0899e3a45635a7792bbe4d4d73d1aa10b1d200ab995bb11254b7

General

Target
2026-07-22_db175f8db2fcfdc0670386e4ba7b781e_coinminer_frostygoop_glassworm_hive_icedid_knight_luca-stealer_njrat_poet-rat_salatstealer_sliver_snatch
Size 28.9MB
Sample260722-vffdpsv1gt
SHA256 74a733cd187e0899e3a45635a7792bbe4d4d73d1aa10b1d200ab995bb11254b7
MD5 db175f8db2fcfdc0670386e4ba7b781e
SHA1 36af377b06328acffab1393582378279a21748e9
SHA512 64d1754bd05f3a2b5a0b476306f6b459741388dbd53674272243772d03f45629db843940e3c1efae3362a3a0aaf3eae8abb6c3d43e03e49fd1050343032ef048
SSDEEP 196608:K7DFDl/mReipYVS1cDr6dub3Zvho9Wyh0E/XU:K7j/mAZhDGuVe9Wyh0YU
TLSH
T140674BC3F8A21AE4D4EA8374C12A815BEA713C191B3923DB1691BF241F377D0AE76715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-07-22_db175f8db2fcfdc0670386e4ba7b781e_coinminer_frostygoop_glassworm_hive_icedid_knight_luca-stealer_njrat_poet-rat_salatstealer_sliver_snatch
- Size 28.9MB
- SHA256 74a733cd187e0899e3a45635a7792bbe4d4d73d1aa10b1d200ab995bb11254b7
- MD5 db175f8db2fcfdc0670386e4ba7b781e
- SHA1 36af377b06328acffab1393582378279a21748e9
- SHA512 64d1754bd05f3a2b5a0b476306f6b459741388dbd53674272243772d03f45629db843940e3c1efae3362a3a0aaf3eae8abb6c3d43e03e49fd1050343032ef048
- SSDEEP 196608:K7DFDl/mReipYVS1cDr6dub3Zvho9Wyh0E/XU:K7j/mAZhDGuVe9Wyh0YU
- TLSH
  T140674BC3F8A21AE4D4EA8374C12A815BEA713C191B3923DB1691BF241F377D0AE76715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access execution spyware stealer defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Deletes itself
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2