oreshki_stealer | 41d87bfa56a9078f774006e241b1cb66c966478575fef6e9957c579b57bc8b05

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:33

Target
41d87bfa56a9078f774006e241b1cb66c966478575fef6e9957c579b57bc8b05.exe
Size 8.8MB
Sample260809-t2n3asvtex
SHA256 41d87bfa56a9078f774006e241b1cb66c966478575fef6e9957c579b57bc8b05
MD5 1e8d9349c2b3f02eebf8fbd8dffddc95
SHA1 c8629aab4a366b165778b84b13fdf9d15fb67157
SHA512 67b9bb34c4a337c11ceeb6c6f668ba90dc7ab30ddf76fc1cfe481f2b1a5368d5b03260743e13677a77600bb5b8f4231b59f7cc0082256f16f22cfb7adeed0883
SSDEEP 98304:aBPaXEE8abgbf8mhIYeo9eTxdEm7WhcJQr:aoXx8Mgb0NpedSQr
TLSH
T136965C07E8A155E8C4AED1308A669253BB717C485B3137E72B90F7382F72BD06EB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: OreshkiStealer
OreshkiStealer is a stealer and trojan written in Golang.
stealer trojan oreshki_stealer

Detects OreshkiStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/2828-0-0x00007FF70AC80000-0x00007FF70B5B6000-memory.dmp	family_oreshki

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/memory/2828-0-0x00007FF70AC80000-0x00007FF70B5B6000-memory.dmp	suspicious_telegram_bot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2828	41d87bfa56a9078f774006e241b1cb66c966478575fef6e9957c579b57bc8b05.exe

C:\Users\Admin\AppData\Local\Temp\41d87bfa56a9078f774006e241b1cb66c966478575fef6e9957c579b57bc8b05.exe
"C:\Users\Admin\AppData\Local\Temp\41d87bfa56a9078f774006e241b1cb66c966478575fef6e9957c579b57bc8b05.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2828