Extracted

• • Target
    2026-08-09_dbca18a77771a659fd860b17e87d3312_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
  • Size 22.1MB
  • SHA256 cf2ae6090340277a90cbb539e086158de9dd78b1eac2cb7eb717cc33507cbcc0
  • MD5 dbca18a77771a659fd860b17e87d3312
  • SHA1 e23ef83ed744a3ee0279b40a9909b145d8b3df02
  • SHA512 840fc542c4bee962eb9d2569a6fff99f2dd9468dd728f670dbedb6d172be8d0236f5bd25e8ff1275b5d7fd3faff298d47f88c7a6b3d3f95720781bbedb8e491a
  • SSDEEP 393216:lFPN6vh15TzEQnErVdLQXzwQ2TaVmpfZjlmIsnJQalz:l1N6vh15jmVdLQDJDVmnkDl
  • TLSH
    T17437CE43F86545E8C4A9D5308A66A263BB717C485B3133D72FA0F6243F76BD0AEB9740
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryexecutionchromelevatorsanta_stealerhacktoolspywarestealerupx

  • Detects ChromElevator

  • Family: ChromElevator

    ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.

    hacktoolchromelevator

  • Family: SantaStealer

    SantaStealer is an information stealer written in C.

    stealersanta_stealer

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2