4d6b422963811adb65620efe279c5293df40aad0ba517dd4e5c50c2d37aebd57

General

Target
2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 14.4MB
Sample260806-b72aps1dmb
SHA256 4d6b422963811adb65620efe279c5293df40aad0ba517dd4e5c50c2d37aebd57
MD5 26d62c1cedba3cb556d90458c0defbf5
SHA1 7c615f0e343111e6eb5945a6b5e03afe68f99893
SHA512 7867040981bb2336922ad6870d85f1ae3f4a037f26b45cd5b52d2e05adf4125953dd9274cce7691352260b33f73dfb0633e742192501dd8fe16df0287079054e
SSDEEP 196608:lgPVXwhLpvPiM+Btyoh9CggQIPCj6NwjyXok:lFhLpvaMqLh9CggQI4mXok
TLSH
T1D8E67C47E8A101E5C0EED535C6669226BA713C885F3563D72B50FB282F73BE0AE79710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 14.4MB
- SHA256 4d6b422963811adb65620efe279c5293df40aad0ba517dd4e5c50c2d37aebd57
- MD5 26d62c1cedba3cb556d90458c0defbf5
- SHA1 7c615f0e343111e6eb5945a6b5e03afe68f99893
- SHA512 7867040981bb2336922ad6870d85f1ae3f4a037f26b45cd5b52d2e05adf4125953dd9274cce7691352260b33f73dfb0633e742192501dd8fe16df0287079054e
- SSDEEP 196608:lgPVXwhLpvPiM+Btyoh9CggQIPCj6NwjyXok:lFhLpvaMqLh9CggQI4mXok
- TLSH
  T1D8E67C47E8A101E5C0EED535C6669226BA713C885F3563D72B50FB282F73BE0AE79710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Detects executables containing artifacts associated with disabling Widnows Defender
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2