6ed2f2943c24b57d50e4a4f494be00c3f908c8e42d4c28694207bf38259b8a8a

General

Target
2026-08-10_d91e1c35bbbbe50b191796b45e7ce296_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
Size 5.0MB
Sample260810-egwt3sdh85
SHA256 6ed2f2943c24b57d50e4a4f494be00c3f908c8e42d4c28694207bf38259b8a8a
MD5 d91e1c35bbbbe50b191796b45e7ce296
SHA1 a655f09867f25244eac1f854db430e7647f10267
SHA512 0385cfe49712707a257342b8adb35e927cfa463e4ab5a860bafebab80feb20aa3a7ebb60503b5e75538bc88e412e998e0819a30158c70673b751f1569d367832
SSDEEP 98304:qwwpndkD80EERQoOLLQ+x5NuGsy1vLIyC6rWFc:qz5H
TLSH
T193364903BE9648F5D095E73589B74252BA74BC4C4B3133E32EA0AAB82F763D06D74B54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-08-10_d91e1c35bbbbe50b191796b45e7ce296_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
- Size 5.0MB
- SHA256 6ed2f2943c24b57d50e4a4f494be00c3f908c8e42d4c28694207bf38259b8a8a
- MD5 d91e1c35bbbbe50b191796b45e7ce296
- SHA1 a655f09867f25244eac1f854db430e7647f10267
- SHA512 0385cfe49712707a257342b8adb35e927cfa463e4ab5a860bafebab80feb20aa3a7ebb60503b5e75538bc88e412e998e0819a30158c70673b751f1569d367832
- SSDEEP 98304:qwwpndkD80EERQoOLLQ+x5NuGsy1vLIyC6rWFc:qz5H
- TLSH
  T193364903BE9648F5D095E73589B74252BA74BC4C4B3133E32EA0AAB82F763D06D74B54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access discovery spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables referencing many Password Manager software clients. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2