svcstealer | fc2a8aa5587525119a6dc27b7318e0a5a4906d18f49f9148f49433d78303438e

General

Target
2026-08-18_641d674e15ef737f8a4f6088b0422827_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch
Size 9.4MB
Sample260818-wdc18sae73
SHA256 fc2a8aa5587525119a6dc27b7318e0a5a4906d18f49f9148f49433d78303438e
MD5 641d674e15ef737f8a4f6088b0422827
SHA1 cbf9ee9a7037af1514af9fa2e9adc75ecd79c05c
SHA512 d27072077d43dca0f892b90915253301905b1a5406647c6a04469991cd09c17d3451529909b2a7289205d5a3a89ae43e1c5f91da5338008b4f98af2be188b7e5
SSDEEP 98304:AHa2VN6/Pd4yB7kGsFHU3yEO92HJIVRiEDr2yG+aVFGEih0HUlc+0dbdnXcoGbr:A1VU/uwOdRvDrRGMEih0ocNdTwr
TLSH
T12CA67B12F98B94FBE5031A3144A7B27F67345D064B3ACBD7EB407A6AEC772914836306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-18_641d674e15ef737f8a4f6088b0422827_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch
- Size 9.4MB
- SHA256 fc2a8aa5587525119a6dc27b7318e0a5a4906d18f49f9148f49433d78303438e
- MD5 641d674e15ef737f8a4f6088b0422827
- SHA1 cbf9ee9a7037af1514af9fa2e9adc75ecd79c05c
- SHA512 d27072077d43dca0f892b90915253301905b1a5406647c6a04469991cd09c17d3451529909b2a7289205d5a3a89ae43e1c5f91da5338008b4f98af2be188b7e5
- SSDEEP 98304:AHa2VN6/Pd4yB7kGsFHU3yEO92HJIVRiEDr2yG+aVFGEih0HUlc+0dbdnXcoGbr:A1VU/uwOdRvDrRGMEih0ocNdTwr
- TLSH
  T12CA67B12F98B94FBE5031A3144A7B27F67345D064B3ACBD7EB407A6AEC772914836306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader execution svcstealer persistence privilege_escalation spyware stealer
- Detects SvcStealer Payload
  SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Family: SvcStealer, Diamotrix
  SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
  stealer downloader svcstealer
- Detect binaries embedding considerable number of MFA browser extension IDs.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects Reflective DLL injection artifacts
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables containing common artifacts observed in infostealers
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Downloads MZ/PE file
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2