90bc2eb40400c33ec147a6bce830cf95ddcb95ffc5865bdcd80f68a01a98c975

General

Target
2026-08-11_9bb86a9f6becf33ca1ac9e2a4a39f2a0_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
Size 3.6MB
Sample260811-2d4rvaek3s
SHA256 90bc2eb40400c33ec147a6bce830cf95ddcb95ffc5865bdcd80f68a01a98c975
MD5 9bb86a9f6becf33ca1ac9e2a4a39f2a0
SHA1 1e8e7296db066e7c6ef88d50638034b735289499
SHA512 ee668d733b1b9f14c004f1f9acdf96dda9dcc83cec601928d9bd8668c7c41d20fdae633439af9cda1e944357c13a68db7a4f4ba739683209ff5e205fe24ec39b
SSDEEP 49152:yem2Q39vEDym0lVo3KFoGcCXRp7cAzeWQ:yQwOaoGcCLQ9V
TLSH
T1B6064A03AE9148EAD195A73588B75152B774BC0C8B3533E73E60BAB82F727D0AD39744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-08-11_9bb86a9f6becf33ca1ac9e2a4a39f2a0_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
- Size 3.6MB
- SHA256 90bc2eb40400c33ec147a6bce830cf95ddcb95ffc5865bdcd80f68a01a98c975
- MD5 9bb86a9f6becf33ca1ac9e2a4a39f2a0
- SHA1 1e8e7296db066e7c6ef88d50638034b735289499
- SHA512 ee668d733b1b9f14c004f1f9acdf96dda9dcc83cec601928d9bd8668c7c41d20fdae633439af9cda1e944357c13a68db7a4f4ba739683209ff5e205fe24ec39b
- SSDEEP 49152:yem2Q39vEDym0lVo3KFoGcCXRp7cAzeWQ:yQwOaoGcCLQ9V
- TLSH
  T1B6064A03AE9148EAD195A73588B75152B774BC0C8B3533E73E60BAB82F727D0AD39744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access discovery spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables referencing many Password Manager software clients. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2