sorano_stealer | f94935de8a082d195a5204fa48d168ac7b89b18c905964181d7f6792d17084f8

General

Target
2026-08-08_a47d1f2ccf85421bee91456c786b2797_coinminer_elex_glassworm_lumma-stealer
Size 4.5MB
Sample260808-np5xdszvez
SHA256 f94935de8a082d195a5204fa48d168ac7b89b18c905964181d7f6792d17084f8
MD5 a47d1f2ccf85421bee91456c786b2797
SHA1 9c76dc476ef7ec5846c55355f848b31b02be7082
SHA512 8c67d35202cfaee5fed0b593db042681aa5738ce93b0dd404aa618d8bcb95c5e8a1bf332991dce690e38e15514340df8789e45d2af7979d8557879d0a63489ea
SSDEEP 98304:iQf3s64R9ybzUcwti78OqJ7TPBF3ZlHHgkWJ0P39qXSaDv:DzUcwti7TQlF3ZxxWJSUnDv
TLSH
T16B261242F3D28072E4BA267056B7573689B9BE115331DAC79BC06C49ADB17F0AE39343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-08_a47d1f2ccf85421bee91456c786b2797_coinminer_elex_glassworm_lumma-stealer
- Size 4.5MB
- SHA256 f94935de8a082d195a5204fa48d168ac7b89b18c905964181d7f6792d17084f8
- MD5 a47d1f2ccf85421bee91456c786b2797
- SHA1 9c76dc476ef7ec5846c55355f848b31b02be7082
- SHA512 8c67d35202cfaee5fed0b593db042681aa5738ce93b0dd404aa618d8bcb95c5e8a1bf332991dce690e38e15514340df8789e45d2af7979d8557879d0a63489ea
- SSDEEP 98304:iQf3s64R9ybzUcwti78OqJ7TPBF3ZlHHgkWJ0P39qXSaDv:DzUcwti7TQlF3ZxxWJSUnDv
- TLSH
  T16B261242F3D28072E4BA267056B7573689B9BE115331DAC79BC06C49ADB17F0AE39343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

costura discovery execution sorano_stealer packer spyware stealer upx
- Detects SoranoStealer payload
- Family: Sorano Stealer
  Sorano Stealer is an open-source information stealer written in C#.
  stealer sorano_stealer
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Detects executables manipulated with Fody
- NirSoft EdgeCookiesView
  Password recovery tool for Microsoft Edge browser
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2