f0d9c3d283e808fa621a4ed0fcc2fc7778ec79e534ccb1706db0f0597065103f

General

Target
2026-08-18_7c700cfe3ef6f32aa023499a05568304_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 9.9MB
Sample260818-hjwtmsfh77
SHA256 f0d9c3d283e808fa621a4ed0fcc2fc7778ec79e534ccb1706db0f0597065103f
MD5 7c700cfe3ef6f32aa023499a05568304
SHA1 c3e6f8a82796e5dbeea004bdd4c02a683c7b7244
SHA512 c975ffddb69e4c67ee22b8f756e2a4d4aca0dcd70502560ba48c022d2e4511a17cfe8c90ceabeebbde5d5eed68f98856b52a40b129759a15b776e3a22d335d49
SSDEEP 98304:ZTfWQmz/1vDpjynNZ2jwQUkusxeEvKaC59v:V8z/1pCwZxvKay
TLSH
T12AA64947E8A501A5C0EDD575C6669263BE713C994F3023D32BA0FB282F77BD0A9B9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-18_7c700cfe3ef6f32aa023499a05568304_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 9.9MB
- SHA256 f0d9c3d283e808fa621a4ed0fcc2fc7778ec79e534ccb1706db0f0597065103f
- MD5 7c700cfe3ef6f32aa023499a05568304
- SHA1 c3e6f8a82796e5dbeea004bdd4c02a683c7b7244
- SHA512 c975ffddb69e4c67ee22b8f756e2a4d4aca0dcd70502560ba48c022d2e4511a17cfe8c90ceabeebbde5d5eed68f98856b52a40b129759a15b776e3a22d335d49
- SSDEEP 98304:ZTfWQmz/1vDpjynNZ2jwQUkusxeEvKaC59v:V8z/1pCwZxvKay
- TLSH
  T12AA64947E8A501A5C0EDD575C6669263BE713C994F3023D32BA0FB282F77BD0A9B9740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables referencing virtualization MAC addresses
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2