General
- Target 2026-08-05_66d831688c4ba988f3ae41b2e432386a_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 12.0MB
- Sample260805-hrl96s1dpg
- SHA256 5690f722f9d2882c3a1f849e719fb6bb0f7034279daadd4357189a2cc1bb7cde
- MD5 66d831688c4ba988f3ae41b2e432386a
- SHA1 6be0df37bae35ad5eacab32fc2f02c49267b3b64
- SHA512 8f7ce22035382c8cff4d299c232275e874e7f874288be165f033f67108389e34e579668eeb62d62506210b5259a8682d1990834c010ecc96569d159717c29859
- SSDEEP 49152:N5Izbtnd0PZjv1dXW9JBImFCws+F91KuyXbF171adQb0PuGbU7OOjgO7bp8sWAJH:kzhnCXWriAC+FDay5bYXfqn46eELM
- TLSH T165C65C11FACB54F6F9036831416BB37F23315D048B28DB9BEB583B6AF877691186A305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-05_66d831688c4ba988f3ae41b2e432386a_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_66d831688c4ba988f3ae41b2e432386a_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-05_66d831688c4ba988f3ae41b2e432386a_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 12.0MB
- SHA256 5690f722f9d2882c3a1f849e719fb6bb0f7034279daadd4357189a2cc1bb7cde
- MD5 66d831688c4ba988f3ae41b2e432386a
- SHA1 6be0df37bae35ad5eacab32fc2f02c49267b3b64
- SHA512 8f7ce22035382c8cff4d299c232275e874e7f874288be165f033f67108389e34e579668eeb62d62506210b5259a8682d1990834c010ecc96569d159717c29859
- SSDEEP 49152:N5Izbtnd0PZjv1dXW9JBImFCws+F91KuyXbF171adQb0PuGbU7OOjgO7bp8sWAJH:kzhnCXWriAC+FDay5bYXfqn46eELM
- TLSH T165C65C11FACB54F6F9036831416BB37F23315D048B28DB9BEB583B6AF877691186A305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detect SalatStealer payload
-
Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Executes dropped EXE