a84cb965d75bbd675925bc99ef5592b26cd231b50774832493a6fdbce9926593

General

Target
2026-08-18_da9e37af01e22246d19e0c003f05b7df_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 10.2MB
Sample260818-g6q18sysgw
SHA256 a84cb965d75bbd675925bc99ef5592b26cd231b50774832493a6fdbce9926593
MD5 da9e37af01e22246d19e0c003f05b7df
SHA1 1c5410909bf3f11f0316e53555980e568a068174
SHA512 d803134d4a078f2b928775a525708e23dfe8c038c85d541799e005b6b000200870eea7370e52cc7634a29ae415221948743a437168bbdc0c414943aafd947f4e
SSDEEP 98304:WxeXe9W7YYdt1VdarsL0pHqeiwxbqXDjYhE2UlOZF2F8J06:WxeEAdt1S1cyqP2UlOZFP
TLSH
T1ACB64A47E8A541E4C0EDD575C6769663BA713C884F3163D32B60FB282F76BD0AAB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-18_da9e37af01e22246d19e0c003f05b7df_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 10.2MB
- SHA256 a84cb965d75bbd675925bc99ef5592b26cd231b50774832493a6fdbce9926593
- MD5 da9e37af01e22246d19e0c003f05b7df
- SHA1 1c5410909bf3f11f0316e53555980e568a068174
- SHA512 d803134d4a078f2b928775a525708e23dfe8c038c85d541799e005b6b000200870eea7370e52cc7634a29ae415221948743a437168bbdc0c414943aafd947f4e
- SSDEEP 98304:WxeXe9W7YYdt1VdarsL0pHqeiwxbqXDjYhE2UlOZF2F8J06:WxeEAdt1S1cyqP2UlOZFP
- TLSH
  T1ACB64A47E8A541E4C0EDD575C6769663BA713C884F3163D32B60FB282F76BD0AAB9700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access defense_evasion discovery execution persistence spyware stealer
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables referencing virtualization MAC addresses
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2