Extracted

• • Target
    2026-05-20_c5f6285e00c16eaa832b6899df15b032_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
  • Size 8.5MB
  • SHA256 c5dd88f2eb2c04558388ec121035cfaaea15bd45f37fba2cb688c4d66b6547c5
  • MD5 c5f6285e00c16eaa832b6899df15b032
  • SHA1 069d79b99e5949899d3ea603dfb57c6262af0071
  • SHA512 12fa99a3ba10ffa2cec6a14fb02e58ea2b24077010d4d6f72ff07438a81e75708af61358b3d9745c3153f322444193ffd4f139a9228be0aea164a4c013f3b56c
  • SSDEEP 49152:r4AvxEFVeqTaoL3v2vqSBxg9FJ6a6wO5bgUgu77nSwFVRe5xYYSd0uMF2V4JVd7v:r446HE5SanzRurU010Dc3gVFM/5ONEp
  • TLSH
    T1FA963917FCA514E9C4ADC1318A669213BB717C890B2123D76F90F7282F76BD0AEB9354
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  evolution_stealerpersistenceprivilege_escalationstealer

  • Detects EvolutionStealer

  • Family: EvolutionStealer

    EvolutionStealer is a Windows stealer written in Golang.

    stealerevolution_stealer

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1