27a4184b97a12dfdfdd97b2d1a1c289ab9c723d63929e3058006ea69fc2bd7a5

General

Target
2026-08-03_0efd2e4b9c80a76dbaa4cf479d9f8f57_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_ngrbot_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 7.0MB
Sample260804-qa43naxvdt
SHA256 27a4184b97a12dfdfdd97b2d1a1c289ab9c723d63929e3058006ea69fc2bd7a5
MD5 0efd2e4b9c80a76dbaa4cf479d9f8f57
SHA1 bfeeb55a75cc3fb9bf2836b6647a81ea31e1c0ef
SHA512 aa8ad0635d39715c50a5239156aa64756d723558d96bd5c3705119e41e9a6ca07ef7ec57da649e146a4922f0bdc4e5fff00e27fbae18c17715eff27616da97c0
SSDEEP 49152:Us6qwAUlGdbqxq6sFB9rohYNr3G3OKOkNf8DwtAP3HYdPmgNHLE+SXcCjKuh4kkr:U63JLSUKff8cMIkk5u+53P69mAEb
TLSH
T180763947FCA155E9C0A9E13489639213BB717C485B3163D32BA0FB282F76BE0AE75750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-03_0efd2e4b9c80a76dbaa4cf479d9f8f57_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_ngrbot_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 7.0MB
- SHA256 27a4184b97a12dfdfdd97b2d1a1c289ab9c723d63929e3058006ea69fc2bd7a5
- MD5 0efd2e4b9c80a76dbaa4cf479d9f8f57
- SHA1 bfeeb55a75cc3fb9bf2836b6647a81ea31e1c0ef
- SHA512 aa8ad0635d39715c50a5239156aa64756d723558d96bd5c3705119e41e9a6ca07ef7ec57da649e146a4922f0bdc4e5fff00e27fbae18c17715eff27616da97c0
- SSDEEP 49152:Us6qwAUlGdbqxq6sFB9rohYNr3G3OKOkNf8DwtAP3HYdPmgNHLE+SXcCjKuh4kkr:U63JLSUKff8cMIkk5u+53P69mAEb
- TLSH
  T180763947FCA155E9C0A9E13489639213BB717C485B3163D32BA0FB282F76BE0AE75750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2