087870620682aad8ed41de223e959b5365c5964fb98b3389e431a86591639c85

General

Target
2026-08-13_53b9b5ec78141813921a55b681772a70_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 9.8MB
Sample260813-flv9sasbrc
SHA256 087870620682aad8ed41de223e959b5365c5964fb98b3389e431a86591639c85
MD5 53b9b5ec78141813921a55b681772a70
SHA1 09d4dcec3b903a018e15ba84b7c10bf0f4b95b8c
SHA512 632b56be627202d1d64420558274cd99d2ecc3958aeaacf1d63d71f8be080b908e773f0afe227cdfc55cb54e7c5de2fb3ca6df4c704ac833997ed8061d4b1b8c
SSDEEP 98304:5OwfajIeAylcr6RpTF4UR/V0HtI1L5bElNnavIEQe5StwF:5HU7qr6Rs9K6rnavIEG
TLSH
T1C9A65A47E8A501A4C0AED575C6669663BE713C984B3473D32F90FB292F37BD06AB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-13_53b9b5ec78141813921a55b681772a70_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 9.8MB
- SHA256 087870620682aad8ed41de223e959b5365c5964fb98b3389e431a86591639c85
- MD5 53b9b5ec78141813921a55b681772a70
- SHA1 09d4dcec3b903a018e15ba84b7c10bf0f4b95b8c
- SHA512 632b56be627202d1d64420558274cd99d2ecc3958aeaacf1d63d71f8be080b908e773f0afe227cdfc55cb54e7c5de2fb3ca6df4c704ac833997ed8061d4b1b8c
- SSDEEP 98304:5OwfajIeAylcr6RpTF4UR/V0HtI1L5bElNnavIEQe5StwF:5HU7qr6Rs9K6rnavIEG
- TLSH
  T1C9A65A47E8A501A4C0AED575C6669663BE713C984B3473D32F90FB292F37BD06AB9700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables referencing virtualization MAC addresses
- Looks for VirtualBox drivers on disk
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2