49e50bc48818070374f6482fca636e67a80540290d37c595131a39700f2763cd

General

Target
2026-08-16_4e628b751d6264e18a2c153877a2918f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver
Size 5.2MB
Sample260816-e93hbsdk31
SHA256 49e50bc48818070374f6482fca636e67a80540290d37c595131a39700f2763cd
MD5 4e628b751d6264e18a2c153877a2918f
SHA1 7312e42def22e274cb384d816bc5235c1865fbd0
SHA512 ad47de9e11dc82f83e8ec3ff273a31eab7496018164a4a12763a95af172b923e30cd468ad5ec1d225bd1ba5ea9239794a9e8111a2c6630c4188b921e8ccfe361
SSDEEP 49152:Tgj5++eNWZkt1tb3eq3tgC6rVgf4yiu14peRBe4KcK9KJIiEa5EBoe:TvtV3ubV64yB1aExEN
TLSH
T14C465A13EC9118E9C1DAA33189A79252BB717C485B3223D72FA0B7782F727C06E79754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-08-16_4e628b751d6264e18a2c153877a2918f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver
- Size 5.2MB
- SHA256 49e50bc48818070374f6482fca636e67a80540290d37c595131a39700f2763cd
- MD5 4e628b751d6264e18a2c153877a2918f
- SHA1 7312e42def22e274cb384d816bc5235c1865fbd0
- SHA512 ad47de9e11dc82f83e8ec3ff273a31eab7496018164a4a12763a95af172b923e30cd468ad5ec1d225bd1ba5ea9239794a9e8111a2c6630c4188b921e8ccfe361
- SSDEEP 49152:Tgj5++eNWZkt1tb3eq3tgC6rVgf4yiu14peRBe4KcK9KJIiEa5EBoe:TvtV3ubV64yB1aExEN
- TLSH
  T14C465A13EC9118E9C1DAA33189A79252BB717C485B3223D72FA0B7782F727C06E79754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access discovery spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables referencing many Password Manager software clients. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2