General
- Target 2026-08-09_c36f410d5e0c704f2014e6af529c9116_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 12.0MB
- Sample260809-fl62aa1bke
- SHA256 5302ae3f022a52189b8efeab27c6721438254d641a7f1da5d46c66c44deaba0e
- MD5 c36f410d5e0c704f2014e6af529c9116
- SHA1 e71bd144926027951ec74fe0285b0a409423a6f3
- SHA512 8b9bbe53c326b7e7ed22f3dec4a34682069561518ba6eea06fcc33c8cd45092a6e0d65f619cc02f34850445dd7239c0cd51a095f157b243ce11ee3c4acd322f0
- SSDEEP 49152:xPiMxiFJNQego14h9O9xwzfcCPgNrag2mSKb7O5tsdRrVoyf4X/FtJBMxyKEqjwe:cMwFg9Ojg0CQrjCK43MMZpR4b4EAO/
- TLSH T119C66C11FACB54F6F9035831416BB27F23315D048B24DB9BEB583B6AF87B69118BA305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-09_c36f410d5e0c704f2014e6af529c9116_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_c36f410d5e0c704f2014e6af529c9116_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_c36f410d5e0c704f2014e6af529c9116_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 12.0MB
- SHA256 5302ae3f022a52189b8efeab27c6721438254d641a7f1da5d46c66c44deaba0e
- MD5 c36f410d5e0c704f2014e6af529c9116
- SHA1 e71bd144926027951ec74fe0285b0a409423a6f3
- SHA512 8b9bbe53c326b7e7ed22f3dec4a34682069561518ba6eea06fcc33c8cd45092a6e0d65f619cc02f34850445dd7239c0cd51a095f157b243ce11ee3c4acd322f0
- SSDEEP 49152:xPiMxiFJNQego14h9O9xwzfcCPgNrag2mSKb7O5tsdRrVoyf4X/FtJBMxyKEqjwe:cMwFg9Ojg0CQrjCK43MMZpR4b4EAO/
- TLSH T119C66C11FACB54F6F9035831416BB27F23315D048B24DB9BEB583B6AF87B69118BA305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detect SalatStealer payload
-
Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Executes dropped EXE