7ce20fd4055dd9c6136892e906a7685d223b1392f75272d595474dc3d1e7d304

General

Target
2026-08-18_77270e636b933de472af2899f36ce016_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 15.5MB
Sample260818-l4hpaszerf
SHA256 7ce20fd4055dd9c6136892e906a7685d223b1392f75272d595474dc3d1e7d304
MD5 77270e636b933de472af2899f36ce016
SHA1 9dd8a7bdf5dc0450496aaa915706fd60e01e6920
SHA512 0e3b343aa2005faf70986b85aa5e7b917bbdb1980071762889486d199267d675213a464aa098bf1da01529311d2a87879e259782753de683dbdcd702ac3ecb6c
SSDEEP 196608:t+2SGSJL6b6Z/wuoloRS1UzUECfFr01sXrDEbHnKPlnWxImL:tYGyq6ZYuy7YUECjXrgbHnmlnWmi
TLSH
T198F68D47ECB545E5C0E99276CA628653BA313C884F3163D76B50B7382F73BD0AAB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-18_77270e636b933de472af2899f36ce016_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 15.5MB
- SHA256 7ce20fd4055dd9c6136892e906a7685d223b1392f75272d595474dc3d1e7d304
- MD5 77270e636b933de472af2899f36ce016
- SHA1 9dd8a7bdf5dc0450496aaa915706fd60e01e6920
- SHA512 0e3b343aa2005faf70986b85aa5e7b917bbdb1980071762889486d199267d675213a464aa098bf1da01529311d2a87879e259782753de683dbdcd702ac3ecb6c
- SSDEEP 196608:t+2SGSJL6b6Z/wuoloRS1UzUECfFr01sXrDEbHnKPlnWxImL:tYGyq6ZYuy7YUECjXrgbHnmlnWmi
- TLSH
  T198F68D47ECB545E5C0E99276CA628653BA313C884F3163D76B50B7382F73BD0AAB9740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery persistence spyware stealer trojan
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables Discord URL observed in first stage droppers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
behavioral1 behavioral2